锐捷交换机做dot1x认证接入，iNode客户端提示身份认证成功，但是安全状态一直卡在未检查

某局点认证方式为802.1x认证，同时使用iMC EAD组件对终端进行防病毒软件的安全检查，启用安全策略后发现iNode终端安全状态一直为“未检查”并且过一会连接自动断开，提示获取IP地址超时，具体现象如下：

1、从问题现象看iNode客户端在802.1x认证成功后如果无法获取到IP地址则无法和iMC 策略服务器通信进行安全检查，所以需要先解决终端无法获取IP地址的问题。同时现场反馈终端不调用安全策略的情况下802.1x认证不会掉线，则需要重点看下安全策略的配置。

2、现场配置的安全策略为设备下发VLAN：

a.    Radius认证请求报文中可以看到终端接入的初始vlanid为vlan 37：

CODE = 1 ID = 62.

       User-Name(1) = ..PmYMGx4GNiN6TBhsI1R5KjAcNbw=  test11@XXX

       NAS-Identifier(32) = PSH-4FIDC-ACC-S5560-1

       Framed-MTU(12) = 1450.

       Framed-Protocol(7) = 1.

       Called-Station-Id(30) = x-x-x-x-x-x

       NAS-Port-Type(61) = 15.

       hw_IP_Host_Addr(60) = 0.0.0.0 00:x

       H3C_NAS_PORT_NAME(230) = GigabitEthernet1/0/10

       NAS-Port(5) = 16818213.

       NAS-Port-Id(87) = slot=1;subslot=0;port=10;vlanid=37 

       H3C_AVPair(210) = nas:ifindex=10

       Acct-Session-Id(44) = 00000004202203030210200000012508100253

       NAS-IP-Address(4) = 168432469.

       Calling-Station-Id(31) = 00-x

       EAP-Message(79) = 020300060304

       Message-Authenticator(80) = de56b9b5784c8fc774b57f96e4bed5aa

       Service-Type(6) = 2.

       State(24) = 03c3d394...s\.X.

       hw_Product_ID(255) = H3C S5560S-52P-EI

       hw_Nas_Startup_Timetamp(59) = 1356998409.

b.    iMC回应设备认证成功报文，同时下发隔离vlan 3：

%% 2022-03-03 10:10:20.593 ; [LDBG] ; [13124] ; LAN ; test11@XXX ; 2 ;  ; fMaVFetE ; Send message attribute list:

Code = 2 ID = 63:

User-Name(1) = ..PmYMGx4GNiN6TBhsI1R5KjAcNbw=  test11@XXX

Service_Type(6) = 2

State(24) = fMaVFetE

Class(25) = fMaVFetE

Termination-Action(29) = 0

Tunnel-Type(64) = 13

Tunnel-Medium-Type(65) = 6

Tunnel-Private-Group-ID(81) = 3 

Session-Timeout(27) = 86400

Acct-Interim-Interval(85) = 28800

hw_User_Notify(61) =

IF_PROXY = 0

IF_DOUBLE_NETCARD = 0

IF_IE_PROXY = 0

FRAMED_IP_SET_MODE = 0

IF_CHECK_MODIFY_MAC = 0

IF_CHECK_SAME_MAC = 0

EIA_DETAIL_VERSION = R003B05D042SP09

EAD_EVENT_SEQ_ID = fMaVFetE

c、设备发送的计费开始报文中携带终端的vlan id仍然是37，但是能看到设备单独携带了一个user_vlan_id 3 ，从b、c步骤的报文来看隔离vlan3是下发成功的。

%% 2022-03-03 10:10:20.640 ; [LDBG] ; [15484] ; LAN ; PmYMGx4GNiN6TBhsI1R5KjAcNbw=  test11@XXX ; 4 ; f9d1be7223894d9a8656ffcf64dd5829 ;  ; Received message from 10.10.19.85:

CODE = 4 ID = 218.

       User-Name(1) = ..PmYMGx4GNiN6TBhsI1R5KjAcNbw=  test11@XXX

       Framed-Protocol(7) = 1.

       Called-Station-Id(30) =x-x-x-x-x-x

       NAS-Port-Type(61) = 15.

       hw_IP_Host_Addr(60) = 0.0.0.0 00:xx:xx:xx:xx:dd

       H3C_NAS_PORT_NAME(230) = GigabitEthernet1/0/10

       NAS-Port(5) = 16818213.

       NAS-Port-Id(87) = slot=1;subslot=0;port=10;vlanid=37 

       H3C_AVPair(210) = nas:ifindex=10

       Acct-Session-Id(44) = 00000004202203030210200000012508100253

       NAS-IP-Address(4) = 168432469.

       Calling-Station-Id(31) = x-x-x-x-x-x

       NAS-Identifier(32) = PSH-4FIDC-ACC-S5560-1

       Class(25) = fMaVFetE

       H3C_USER_VLAN_ID(133) = 3.

       Acct-Authentic(45) = 1.

       Acct-Status-Type(40) = 1.

       Acct-Delay-Time(41) = 0.

       Event-Timestamp(55) = 1646273420.

       hw_Product_ID(255) = H3C S5560S-52P-EI

       hw_Nas_Startup_Timetamp(59) = 1356998409.

d. iMC回应设备的计费响应报文中携带EAD 策略服务器IP为10.10.7.5 ，后续iNode和这个地址通信发起EAD安全认证请求报文。

%% 2022-03-03 10:10:20.640 ; [LDBG] ; [10624] ; LAN ; test11@XXX ; 5 ; f9d1be7223894d9a8656ffcf64dd5829 ; fMaVFetE ; Send message attribute list:

Code = 5 ID = 218:

hw_User_Notify(61) =

EAD_EVENT_SEQ_ID = fMaVFetE

EAD_PROXY_IP = 168429317 

EAD_PROXY_PORT = 9019

EAD_PROXY_IP_PREFERENCE = 0

IF_DEPLOY_EMO = 0

ISP_EMO_UDP_PORT = 0

ISP_EMO_TCP_PORT = 0

e. iMC收到设备发送的计费结束报文，报文中可以看到没有携带终端的IP地址，可以说明终端在掉线的时候仍未获取到地址：

%% 2022-03-03 10:12:26.610 ; [LDBG] ; [15484] ; LAN ; PmYMGx4GNiN6TBhsI1R5KjAcNbw=  test11@XXX ; 4 ; 293457ff5a9f494f9de363b360c0d1b7 ;  ; Received message from 10.10.19.85:

CODE = 4 ID = 34.

       User-Name(1) = ..PmYMGx4GNiN6TBhsI1R5KjAcNbw=  test11@XXX

       Framed-Protocol(7) = 1.

       Called-Station-Id(30) = x-x-x-x-x-x

       NAS-Port-Type(61) = 15.

       hw_IP_Host_Addr(60) = 0.0.0.0 00:xx:xx:xx:xx:dd

       H3C_NAS_PORT_NAME(230) = GigabitEthernet1/0/10

       NAS-Port(5) = 16818213.

       NAS-Port-Id(87) = slot=1;subslot=0;port=10;vlanid=37

       H3C_AVPair(210) = nas:ifindex=10

       Acct-Session-Id(44) = 00000004202203030210200000012508100253

       NAS-IP-Address(4) = 168432469.

       Calling-Station-Id(31) = x-x-x-x-x-x

       NAS-Identifier(32) = PSH-4FIDC-ACC-S5560-1

       Class(25) = fMaVFetE       Acct-Terminate-Cause(49) = 1. 

       H3C_USER_VLAN_ID(133) = 3.

       Acct-Session-Time(46) = 126.

       Acct-Authentic(45) = 1.

       Acct-Status-Type(40) = 2.

       Acct-Delay-Time(41) = 0.

       Event-Timestamp(55) = 1646273546.

       hw_Product_ID(255) = H3C S5560S-52P-EI

       hw_Nas_Startup_Timetamp(59) = 1356998409.

安全策略配置了隔离vlan和安全vlan，身份认证成功后先下发隔离vlan，客户端获取隔离vlan ip，安全检查通过后下发安全vlan，客户端重新获取安全vlan的IP，但不论是隔离vlan还是安全vlan，都需要保证终端获取到的地址可以和iMC策略服务器通信，此问题后续需要重点检查网络和DHCP配置，使终端能获取对应vlan的地址。