802.1x radius 下发 vlan 交换机s5130不动作

802.1x 认证成功，但下发的vlan 交换机 s5130 不动作，仍旧使用vlan1

debug radius 可以观察到服务器下发了三条属性，vlan是104

freeradius 3 认证是成功

s5130 接收到了 用户属性

*Apr 27 15:04:32:468 2021 H3C SW RADIUS/7/PACKET:

    Framed-Protocol=PPP

    Framed-Compression=Van-Jacobson-TCP-IP

    Tunnel-Type:0=VLAN

    Tunnel-Medium-Type:0=IEEE-802

    Tunnel-Private-Group-Id:0="104"

    EAP-Message=0x010e00061920

    Message-Authenticator=0xa5194a6a10adef886f794e518d95353b

    State=0x38090a8d390713640f536e1bad07c576

交换机的log

%Apr 27 15:10:54:305 2021 H3C SW DOT1X/6/DOT1X_LOGIN_SUCC: -IfName=GigabitEthernet1/0/41-MACAddr=8c04-ba1a-e77a-AccessVLANID=1-AuthorizatiOnVLANID=1-Username=test-win10; User passed 802.1X authentication and came online.

显示dot1x 如下

dis dot1x

 Global 802.1X parameters:

   802.1X authentication                : Enabled

   EAP authentication                   : Enabled

   Max-tx period                        : 30 s

   Handshake period                     : 15 s

   Quiet timer                          : Disabled

       Quiet period                     : 60 s

   Supp timeout                         : 30 s

   Server timeout                       : 100 s

   Reauth period                        : 3600 s

   Max auth requests                    : 2

   User aging period for Auth-Fail VLAN : 1000 s

   User aging period for critical VLAN  : 1000 s

   User aging period for guest VLAN     : 1000 s

   EAD assistant function               : Disabled

       EAD timeout                      : 30 min

   Domain delimiter                     : @

   Max EAP-TLS-fragment (to-server)     : N/A

 Online 802.1X wired users              : 1

 GigabitEthernet1/0/41  is link-up

   802.1X authentication            : Enabled

   Handshake                        : Disabled

   Handshake reply                  : Disabled

   Handshake security               : Disabled

   Unicast trigger                  : Enabled

   Periodic reauth                  : Disabled

   Port role                        : Authenticator

   Authorization mode               : Auto

   Port access control              : Port-based

   Multicast trigger                : Disabled

   Mandatory auth domain            : Not configured

   Guest VLAN                       : Not configured

   Auth-Fail VLAN                   : Not configured

   Critical VLAN                    : Not configured

   Critical voice VLAN              : Disabled

   Add Guest VLAN delay             : Disabled

   Re-auth server-unreachable       : Logoff

   Max online users                 : 4294967295

   User IP freezing                 : Disabled

   Reauth period                    : 0 s

   Send Packets Without Tag         : Disabled

   Max Attempts Fail Number         : 0

   User aging                       : Enabled

   Server-recovery online-user-sync : Disabled

   Auth-Fail EAPOL                  : Disabled

   Critical EAPOL                   : Disabled

   Discard duplicate EAPOL-Start    : No

dis dot  con

Total connections: 1

Slot ID: 1

User MAC address: 8c04-ba1a-e77a

Access interface: GigabitEthernet1/0/41

Username: test-win10

User access state: Successful

Authentication domain: sjgs

Authentication method: EAP

Initial VLAN: 1

Authorization untagged VLAN: N/A

Authorization tagged VLAN list: N/A

Authorization ACL number/name: N/A

Authorization user profile: test

Authorization CAR: N/A

Authorization URL: N/A

Termination action: Default

Session timeout period: N/A

Online from: 2021/04/27 15:18:28

Online duration: 0h 15m 12s

交换机信息

BOARD TYPE:         S5130S-52S-LI

Release Version:    H3C S5130S-52S-LI-6326

交换机 配置:

 dot1x

 dot1x authentication-method eap

 dot1x access-user log enable abnormal-logoff failed-login normal-logoff successful-login

vlan 1

#

vlan 2 to 4094

interface GigabitEthernet1/0/41

 dot1x

 undo dot1x handshake

 undo dot1x multicast-trigger

 dot1x port-method portbased

 dot1x unicast-trigger

#

radius scheme sjgs52

 primary authentication 192.168.136.52 key cipher

 primary accounting 192.168.136.52 key cipher

 user-name-format without-domain

#

radius scheme system

 user-name-format without-domain

#

domain sjgs

 authorization-attribute user-profile test

 authentication lan-access radius-scheme sjgs52

 authorization lan-access radius-scheme sjgs52

 accounting lan-access radius-scheme sjgs52