WA5530S 胖模式 802.1X 用户无法认证

AP报错

-Username=<username>-UserMAC=<usermac>-BSSID=<bssid>-SSID=<SSID>-APName=fatap-RadioID=1-VLANID=50; A user failed 802.1X authentication.Reason:AAA processed authentication request and return 26.

后端 freeradius 服务器报错

(9) eap: Peer sent EAP Response (code 2) ID 5 length 17
(9) eap: Continuing tunnel setup
(9) [eap] = ok
(9) } # authorize = ok
(9) Found Auth-Type = eap
(9) # Executing group from file /etc/raddb/sites-enabled/default
(9) authenticate {
(9) eap: Expiring EAP session with state 0x9b2314ae98260dea
(9) eap: Finished EAP session with state 0x9b2314ae98260dea
(9) eap: Previous EAP request found for state 0x9b2314ae98260dea, released from the list
(9) eap: Peer sent packet with method EAP PEAP (25)
(9) eap: Calling submodule eap_peap to process data
(9) eap_peap: Continuing EAP-TLS
(9) eap_peap: Peer indicated complete TLS record size will be 7 bytes
(9) eap_peap: Got complete TLS record (7 bytes)
(9) eap_peap: [eaptls verify] = length included
(9) eap_peap: <<< recv TLS 1.2 [length 0002]
(9) eap_peap: ERROR: TLS Alert read:fatal:unknown CA
(9) eap_peap: TLS_accept: Need to read more data: error
(9) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read): error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca
(9) eap_peap: TLS - In Handshake Phase
(9) eap_peap: TLS - Application data.
(9) eap_peap: ERROR: TLS failed during operation
(9) eap_peap: ERROR: [eaptls process] = fail
(9) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed
(9) eap: Sending EAP Failure (code 4) ID 5 length 4
(9) eap: Failed in EAP select
(9) [eap] = invalid
(9) } # authenticate = invalid
(9) Failed to authenticate the user
(9) Using Post-Auth-Type Reject

这款应该是支持802.1X的，然而和不支持的 WA6320C 报了同样的错

https://zhiliao.h3c.com/questions/dispcont/141135

配置如下（部分字段隐去）

#
version 7.1.064, Release 2444P01
#
sysname H3C
#
wlan global-configuration
#
telnet server enable
#
dot1x
dot1x authentication-method eap
dot1x retry 3
dot1x timer supp-timeout 2
dot1x timer tx-period 4
#
lldp global enable
lldp hold-multiplier 8
#
password-recovery enable
#
vlan 1
#
vlan 50
#
vlan 120
#
wlan service-template 1
ssid H3C
service-template enable
#
wlan service-template
ssid
vlan 120
user-isolation enable
akm mode psk
preshared-key pass-phrase cipher
cipher-suite ccmp
cipher-suite tkip
security-ie rsn
security-ie wpa
service-template enable
#
wlan service-template
ssid
vlan 50
akm mode dot1x
cipher-suite ccmp
security-ie rsn
client-security authentication-mode dot1x
dot1x domain<***.***>
service-template enable
#
interface NULL0
#
interface Vlan-interface1
ip address 192.168.0.50 255.255.255.0
#
interface Vlan-interface50
ip address 192.168.50.234 255.255.255.0
#
interface GigabitEthernet1/0/1
port link-type trunk
port trunk permit vlan 1 50 60 120
port-isolate enable
#
interface GigabitEthernet1/0/2
port-isolate enable
#
interface WLAN-Radio1/0/1
service-template
service-template
channel band-width dual-80
#
interface WLAN-Radio1/0/2
service-template
service-template
#
interface WLAN-Radio1/0/3
service-template
service-template
#
interface WLAN-Mesh1
#
interface WLAN-Mesh2
#
scheduler logfile size 16
#
line class console
user-role network-admin
#
line class vty
user-role network-operator
#
line con 0
user-role network-admin
#
line vty 0 31
authentication-mode scheme
user-role network-operator
#
line vty 32 63
user-role network-operator
#
rib
#
ip route-static 0.0.0.0 0 192.168.50.254
#
radius session-control enable
#
radius scheme<***.***>
primary authentication 192.168.10.152 key cipher
primary accounting 192.168.10.152 key cipher
user-name-format keep-original
nas-ip 192.168.50.234
#
domain<***.***>
authorization-attribute idle-cut 15 1024
authentication lan-access radius-scheme<***.***>
authorization lan-access radius-scheme<***.***>
accounting lan-access radius-scheme<***.***>
#
domain system
#
domain default enable system
#
role name level-0
description Predefined level-0 role
#
role name level-1
description Predefined level-1 role
#
role name level-2
description Predefined level-2 role
#
role name level-3
description Predefined level-3 role
#
role name level-4
description Predefined level-4 role
#
role name level-5
description Predefined level-5 role
#
role name level-6
description Predefined level-6 role
#
role name level-7
description Predefined level-7 role
#
role name level-8
description Predefined level-8 role
#
role name level-9
description Predefined level-9 role
#
role name level-10
description Predefined level-10 role
#
role name level-11
description Predefined level-11 role
#
role name level-12
description Predefined level-12 role
#
role name level-13
description Predefined level-13 role
#
role name level-14
description Predefined level-14 role
#
user-group system
#
local-user admin class manage
password hash
service-type telnet http https
authorization-attribute user-role network-admin
#
ip http enable
ip https enable
#
undo attack-defense tcp fragment enable
#
return