S9500交换机配置AAA、RADIUS之后用户不通过认证就能使用网络问题处理方法

S9500交换机配置AAA、RADIUS之后用户不通过认证就能使用网络问题处理方法

 

一、故障处理流程

图一、配置AAA、RADIUS之后用户不通过认证就能使用网络故障处理流程

二、故障处理步骤

1）步骤1

    检查全局和端口模式是否使能dot1x，可以通过dis dot1x 来查看全局是否使能该功能。同时对于1263以后的版本可以使用display dot1x enabled-interface来查看使能dot1x的端口。之前的版本可以通过dis dot1x interface <port>来查看。如果确定配置正确，请转步骤2。

2）步骤2 

    确定端口控制方式是否配置为auto方式，如果不是auto方式，需要通过配置dot1x port-control auto修改模式为auto。确定端口控制方式正确，请转步骤3。

 [S9500]dis dot1x interface g3/1/1                       

 Equipment 802.1X protocol is enabled                      

 CHAP authentication is enabled                                                

 DHCP-launch is disabled                                                       

 Proxy trap checker is disabled                                                 

 Proxy logoff checker is disabled                                                                                                                              

 Configuration: Transmit Period     30 s,  Handshake Period    30 s          

              Quiet Period        60 s,  Quiet Period Timer is disabled      

              Supp Timeout       30 s,  Server Timeout      100 s        

                The maximal retransmitting times      2                    

                Total maximum 802.1x user resource number is 2048  

                Total current used 802.1x resource number is 0                                              

 GigabitEthernet3/1/1  is link-up   

   802.1X protocol is enabled     

   Proxy trap checker is disabled    

   Proxy logoff checker is disabled  

   The port is a(n) authenticator  

   Authenticate Mode is auto                                                   

   Port Control Type is Mac-based                                              

   Max on-line user number is 1024                                                                                                                             

   Authenticate Success: 0, Failed: 0                                          

   EAPOL Packet: Tx 22, Rx 0                                                   

   Send EAP Request/Identity Packet : 22                                       

        EAP Request/Challenge Packet: 0                                        

        EAP Success Packet: 0                                                  

        EAP Failure Packet: 0                                                  

   Received EAPOL Start Packet : 0                                             

            EAPOL LogOff Packet: 0                                              

            EAP Response/Identity Packet : 0                                   

            EAP Response/Challenge Packet: 0                                   

            Error Packet: 0                                                                                                                             

   Controlled User(s) amount to 0

3）步骤3

    检查端口控制方法是mac-based还是 port-based。如果是port-based，该端口只要有任何一个人通过认证，其他人不用认证即可使用网络。

4）步骤4

    上述步骤无法定位问题，请联系800进一步处理。