问题描述：
小贝无线控制器开启dot1x 认证，远端radiu认证服务器，无线控制器到radius认证服务器路由可达，可以ping通，但是终端笔记本连接无线后，弹出输入账号密码界面，输入后无任何反应，重新恢复输入账号密码界面。在无线控制器上debugg radius 信息如下， 请懂得帮忙分析一下是什么问题？
<AC>*May 21 15:21:41:939 2026 AC RADIUS/7/EVENT:
PAM_RADIUS: Processing RADIUS authentication.
*May 21 15:21:41:939 2026 AC RADIUS/7/EVENT:
PAM_RADIUS: Sent authentication request successfully.
*May 21 15:21:41:939 2026 AC RADIUS/7/EVENT:
Processing AAA request data.
*May 21 15:21:41:939 2026 AC RADIUS/7/EVENT:
Got request data successfully, primitive: authentication.
*May 21 15:21:41:939 2026 AC RADIUS/7/EVENT:
Getting RADIUS server info.
*May 21 15:21:41:939 2026 AC RADIUS/7/EVENT:
Got RADIUS server info successfully.
*May 21 15:21:41:939 2026 AC RADIUS/7/EVENT:
Created request context successfully.
*May 21 15:21:41:939 2026 AC RADIUS/7/EVENT:
Created request packet successfully, dstIP: 10.133.89.16, dstPort: 1812, VPN instance: --(public), socketFd: 211, pktID: 77.
*May 21 15:21:41:939 2026 AC RADIUS/7/EVENT:
Added packet socketfd to epoll successfully, socketFd: 211.
*May 21 15:21:41:939 2026 AC RADIUS/7/EVENT:
Mapped PAM item to RADIUS attribute successfully.
*May 21 15:21:41:939 2026 AC RADIUS/7/EVENT:
Got RADIUS username format successfully, format: 0.
*May 21 15:21:41:939 2026 AC RADIUS/7/EVENT:
Added attribute user-name successfully, user-name: qinan.
*May 21 15:21:41:939 2026 AC RADIUS/7/EVENT:
Filled RADIUS attributes in packet successfully.
*May 21 15:21:41:939 2026 AC RADIUS/7/EVENT:
Composed request packet successfully.
*May 21 15:21:41:939 2026 AC RADIUS/7/EVENT:
Created response timeout timer successfully.
*May 21 15:21:41:939 2026 AC RADIUS/7/PACKET:
User-Name="qinan"
Service-Type=Framed-User
Framed-Protocol=PPP
NAS-Identifier="AC"
NAS-Port=16777311
NAS-Port-Type=Wireless-802.11
NAS-Port-
Calling-Station-
Called-Station-
H3c-Nas-Startup-Timestamp=1293840011
Acct-Session-
H3c-User-Vlan-Id=95
EAP-Message=0x0201000a0171696e616e
Message-Authenticator=0x00000000000000000000000000000000
Framed-MTU=1450
H3c-Ip-Host-Addr="0.0.0.0 50:5b:c2:d6:eb:b9"
H3C-MAC-Proxy-Authenticator=******
NAS-IP-Address=10.153.82.253
H3c-Product-
*May 21 15:21:41:940 2026 AC RADIUS/7/EVENT:
Sent request packet successfully.
*May 21 15:21:41:940 2026 AC RADIUS/7/PACKET:
01 4d 01 2f 22 2b 20 14 82 50 9d c2 ae c6 db 06
25 d4 2b 25 01 07 71 69 6e 61 6e 06 06 00 00 00
02 07 06 00 00 00 01 20 04 41 43 05 06 01 00 00
5f 3d 06 00 00 00 13 57 12 30 31 30 30 30 30 30
30 30 30 30 30 30 30 39 35 1f 13 35 30 2d 35 42
2d 43 32 2d 44 36 2d 45 42 2d 42 39 1e 1a 45 43
2d 44 41 2d 35 39 2d 30 46 2d 32 36 2d 36 30 3a
37 35 32 35 31 35 1a 0c 00 00 63 a2 3b 06 4d 1e
6e 8b 2c 28 30 30 30 30 30 30 30 34 32 30 32 36
30 35 32 31 30 37 32 31 34 31 30 30 30 30 30 30
31 33 30 38 31 30 30 31 38 31 1a 0c 00 00 63 a2
85 06 00 00 00 5f 4f 0c 02 01 00 0a 01 71 69 6e
61 6e 50 12 50 b2 eb df ed 9d 59 14 f3 fd 39 8a
2c 93 af 09 0c 06 00 00 05 aa 1a 21 00 00 63 a2
3c 1b 30 2e 30 2e 30 2e 30 20 35 30 3a 35 62 3a
*May 21 15:21:41:940 2026 AC RADIUS/7/PACKET:
63 32 3a 64 36 3a 65 62 3a 62 39 1a 18 00 00 63
a2 96 12 da ab 68 60 5b 87 14 16 3f a6 d7 4f cc
ec f2 f3 04 06 0a 99 52 fd 1a 16 00 00 63 a2 ff
10 48 33 43 20 4d 53 47 33 36 30 2d 31 30 53
*May 21 15:21:41:940 2026 AC RADIUS/7/EVENT:
Sent request packet and create request context successfully.
*May 21 15:21:41:940 2026 AC RADIUS/7/EVENT:
Added request context to global table successfully.
*May 21 15:21:41:940 2026 AC RADIUS/7/EVENT:
Processing AAA request data.
*May 21 15:21:41:940 2026 AC RADIUS/7/EVENT:
Processing AAA request data.
*May 21 15:21:41:940 2026 AC RADIUS/7/EVENT:
Processing AAA request data.
*May 21 15:21:52:435 2026 AC RADIUS/7/EVENT:
Response timed out.
*May 21 15:21:52:435 2026 AC RADIUS/7/EVENT:
Found request context, dstIP: 10.133.89.16; dstPort: 1812; VPN instance: --(public); socketfd: 211; pktID:77.
*May 21 15:21:52:435 2026 AC RADIUS/7/EVENT:
Retransmitting request packet, currentTries: 2, maxTries: 3.
*May 21 15:22:02:435 2026 AC RADIUS/7/EVENT:
Response timed out.
*May 21 15:22:02:435 2026 AC RADIUS/7/EVENT:
Found request context, dstIP: 10.133.89.16; dstPort: 1812; VPN instance: --(public); socketfd: 211; pktID:77.
*May 21 15:22:02:435 2026 AC RADIUS/7/EVENT:
Retransmitting request packet, currentTries: 3, maxTries: 3.
*May 21 15:22:12:435 2026 AC RADIUS/7/EVENT:
Response timed out.
%May 21 15:22:12:435 2026 AC DOT1X/5/DOT1X_WLAN_LOGIN_FAILURE: -Username=qinan-UserMAC=505b-c2d6-ebb9-BSSID=ecda-590f-2662-SSID=752515-APName=ecda-590f-2660-RadioID=1-VLANID=95; A user failed 802.1X authentication.Reason:AAA processed authentication request and return 8.
*May 21 15:22:12:435 2026 AC RADIUS/7/EVENT:
Found request context, dstIP: 10.133.89.16; dstPort: 1812; VPN instance: --(public); socketfd: 211; pktID:77.
*May 21 15:22:12:435 2026 AC RADIUS/7/EVENT:
Reached the maximum retries.
*May 21 15:22:12:435 2026 AC RADIUS/7/EVENT:
Set status of server to block successfully. serverIP: 10.133.89.16, serverPort: 1812.
*May 21 15:22:12:435 2026 AC RADIUS/7/EVENT:
Got next server failed.
*May 21 15:22:12:435 2026 AC RADIUS/7/EVENT:
Sent reply error message to PAM.
*May 21 15:22:12:435 2026 AC RADIUS/7/EVENT:
Sent reply message successfully.
*May 21 15:22:12:435 2026 AC RADIUS/7/EVENT:
PAM_RADIUS: Processing RADIUS authentication.
*May 21 15:22:12:435 2026 AC RADIUS/7/EVENT:
PAM_RADIUS: Fetched authentication reply-data successfully, resultCode: 3
*May 21 15:22:12:437 2026 AC RADIUS/7/EVENT:
Received status of server changing event.
*May 21 15:23:24:508 2026 AC RADIUS/7/EVENT:
Set server to active state. serverIP: 10.133.89.16, serverPort: 1812.
*May 21 15:23:24:509 2026 AC RADIUS/7/EVENT:
Received status of server changing event.
*May 21 15:23:24:510 2026 AC RADIUS/7/EVENT:
Aaad sent notification about the change of server status to application process successfully. Server state: active.
*May 21 15:23:24:510 2026 AC RADIUS/7/EVENT:
Application process received the notification about the change of server status from aaad process. Server state: active.
*May 21 15:23:24:692 2026 AC RADIUS/7/EVENT:
Set server to active state. serverIP: 10.133.89.16, serverPort: 1812.
*May 21 15:23:24:692 2026 AC RADIUS/7/EVENT:
Application process received the notification about the change of server status from aaad process. Server state: active.
*May 21 15:23:24:693 2026 AC RADIUS/7/EVENT:
Received status of server changing event.
*May 21 15:23:24:695 2026 AC RADIUS/7/EVENT:
Set server to active state. serverIP: 10.133.89.16, serverPort: 1812.
*May 21 15:23:24:695 2026 AC RADIUS/7/EVENT:
Received status of server changing event.
*May 21 15:23:24:746 2026 AC RADIUS/7/EVENT:
Set server to active state. serverIP: 10.133.89.16, serverPort: 1812.
*May 21 15:23:24:746 2026 AC RADIUS/7/EVENT:
Application process received the notification about the change of server status from aaad process. Server state: active.
*May 21 15:23:24:747 2026 AC RADIUS/7/EVENT:
Received status of server changing event.
*May 21 15:23:24:832 2026 AC RADIUS/7/EVENT:
Set server to active state. serverIP: 10.133.89.16, serverPort: 1812.
*May 21 15:23:24:832 2026 AC RADIUS/7/EVENT:
Application process received the notification about the change of server status from aaad process. Server state: active.
*May 21 15:23:24:832 2026 AC RADIUS/7/EVENT:
Received status of server changing event.
*May 21 15:23:25:133 2026 AC RADIUS/7/EVENT:
Set server to active state. serverIP: 10.133.89.16, serverPort: 1812.
*May 21 15:23:25:133 2026 AC RADIUS/7/EVENT:
Application process received the notification about the change of server status from aaad process. Server state: active.
*May 21 15:23:25:133 2026 AC RADIUS/7/EVENT:
Received status of server changing event.
*May 21 15:23:25:144 2026 AC RADIUS/7/EVENT:
Set server to active state. serverIP: 10.133.89.16, serverPort: 1812.
*May 21 15:23:25:144 2026 AC RADIUS/7/EVENT:
Application process received the notification about the change of server status from aaad process. Server state: active.
*May 21 15:23:25:144 2026 AC RADIUS/7/EVENT:
Received status of server changing event.
*May 21 15:23:25:431 2026 AC RADIUS/7/EVENT:
Set server to active state. serverIP: 10.133.89.16, serverPort: 1812.
*May 21 15:23:25:432 2026 AC RADIUS/7/EVENT:
Application process received the notification about the change of server status from aaad process. Server state: active.
*May 21 15:23:25:432 2026 AC RADIUS/7/EVENT:
Received status of server changing event.
*May 21 15:23:25:435 2026 AC RADIUS/7/EVENT:
Application process received the notification about the change of server status from aaad process. Server state: active.
*May 21 15:23:25:508 2026 AC RADIUS/7/EVENT:
Application process received the notification about the change of server status from aaad process. Server state: active.
%May 21 15:23:42:578 2026 AC DOT1X/5/DOT1X_WLAN_LOGIN_FAILURE: -Username=-UserMAC=505b-c2d6-ebb9-BSSID=ecda-590f-2662-SSID=752515-APName=ecda-590f-2660-RadioID=1-VLANID=95; A user failed 802.1X authentication.Reason:802.1X user timer timed out.
%May 21 15:25:12:778 2026 AC DOT1X/5/DOT1X_WLAN_LOGIN_FAILURE: -Username=-UserMAC=505b-c2d6-ebb9-BSSID=ecda-590f-2662-SSID=752515-APName=ecda-590f-2660-RadioID=1-VLANID=95; A user failed 802.1X authentication.Reason:802.1X user timer timed out.
根据日志分析，问题很明确：AC（无线控制器）和 RADIUS 服务器之间网络虽然通了，但 RADIUS 认证报文被拒绝了。
日志里最关键的几行是：*May 21 15:21:52:435 2026 AC RADIUS/7/EVENT: Response timed out.
AC 成功把认证请求发给了 RADIUS 服务器（
10.133.89.16）。但它在规定时间内没收到服务器的回应，于是触发超时重传。
重试了 3 次都没回应，AC 就把这台服务器暂时“拉黑”（
Set status of server to block）。最终认证失败，错误代码
return 8通常也意味着 RADIUS 服务器无响应或请求超时。
简单说，就是 AC 和 RADIUS 服务器“握手”失败。虽然 ping 能通，但 RADIUS 协议（UDP 1812端口）的通信没建立起来。
问题排查步骤
建议按下面几个方向，从简到繁逐一排查：
1. 检查 RADIUS 服务器的防火墙
这是最可能的原因。需要登录 RADIUS 服务器（10.133.89.16），检查系统防火墙或安全软件是否放行了 UDP 1812 端口。如果没放行，需要添加规则允许来自 AC 管理 IP（10.153.82.253）的该端口访问。
2. 核对 AC 和服务器间的共享密钥
双方配置的共享密钥（shared secret）必须完全一致，否则服务器会直接丢弃请求，导致 AC 收不到任何回应。可以在 AC 上用 display radius scheme 命令确认，并与服务器端仔细核对。
3. 检查服务器上的 RADIUS 服务状态
确认 RADIUS 服务（如 Windows 的 NPS，或 FreeRADIUS）正在运行，且配置为在 UDP 1812 端口上监听来自所有有效 IP 的请求。
4. 检查中间链路的安全策略
如果 AC 和服务器之间有防火墙或交换机，也要检查它们上面的 ACL 规则，确保没有阻止 AC 到服务器的 UDP 1812 流量。
5. 检查 RADIUS 服务器可达性
虽然 ping 能通，但从业务网段发起的连通性测试更有意义。可以在 AC 上用 ping -a 10.153.82.253 10.133.89.16 命令，模拟从 AC 源 IP 发出的探测，确认无丢包。
快速测试方法
可以在 Windows 服务器上用抓包工具（如 Wireshark），或通过简单的端口测试命令Test-NetConnection -ComputerName 10.133.89.16 -Port 1812来验证。
暂无评论
编辑答案
亲~登录后才可以操作哦!
确定你的邮箱还未认证，请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
- 1. 您举报的内容是什么？（请在邮件中列出您举报的内容和链接地址）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
- 3. 是哪家企业？（营业执照，单位登记证明等证件）
- 4. 您与该企业的关系是？（您是企业法人或被授权人，需提供企业委托授权书）
抄袭了我的内容
×
原文链接或出处
诽谤我
×
- 1. 您举报的内容以及侵犯了您什么权益？（请在邮件中列出您举报的内容、链接地址，并给出简短的说明）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
对根叔社区有害的内容
×
不规范转载
×
举报说明
暂无评论