M-LAG场景下portal认证NAS-IP配置一致导致向设备发送请求超时

终端通过企业微信扫码认证出现向设备发送请求超时的提示

确定NAS-IP和Portal服务器地址后debug查看报文交互过程

debugging radius all 
debugging portal all
acl ad 3000
 rule 5 permit ip source 10.30.63.17 0.0.0.0 des 10.30.80.10 0.0.0.0 
 debugging udp packet acl 3000
t m
t d

在DeviceA上debug发现没收到服务器radius的回包，现网配置两台设备nas-ip一样，怀疑回包hash到DeviceB上去了。

*Jan 16 21:57:03:091 2026 YP01-2FC03-OA-H3CS7503X-HJSW02 RADIUS/7/EVENT: Retransmitting request packet, currentTries: 3, maxTries: 3.
*Jan 16 21:57:06:091 2026 YP01-2FC03-OA-H3CS7503X-HJSW02 RADIUS/7/EVENT: Reached the maximum retries.

M-LAG场景下portal认证NAS-IP配置有以下两个注意事项：

1、 使用双活网关接口地址作为nas-ip源地址时，需要配置virtal-ip

A设备

interface Vlan-interface902

   ip address 10.30.63.17 255.255.255.248

port mlag virtual-ip 10.30.63.18 255.255.255.248 active

port mlag virtual-ip 10.30.63.19 255.255.255.248 standby

mac-address 0058-0058-0058

#

B设备

interface Vlan-interface902

ip address 10.30.63.17 255.255.255.248

port mlag virtual-ip 10.30.63.19 255.255.255.248 active

port mlag virtual-ip 10.30.63.18 255.255.255.248 standby

  mac-address 0058-0058-0058

#

2、 使用双活网关接口地址作为nas-ip源地址时，需要在radius scheme内配置nas-ip m-lag local peer命令

A设备

radius scheme ldtest

primary authentication 10.30.80.10

primary accounting 10.30.80.10

key authentication cipher $c$3$ruYqQq35y7KVUNEUuB7iFbx+GDO9CI27sg==

key accounting cipher $c$3$k02A1EzoWZtArU1w14p+glFfUJmaSbMKBQ==

user-name-format without-domain

nas-ip m-lag local 10.30.63.18 peer 10.30.63.19

#B设备

radius scheme ldtest

primary authentication 10.30.80.10

primary accounting 10.30.80.10

key authentication cipher $c$3$ruYqQq35y7KVUNEUuB7iFbx+GDO9CI27sg==

key accounting cipher $c$3$k02A1EzoWZtArU1w14p+glFfUJmaSbMKBQ==

user-name-format without-domain

nas-ip m-lag local 10.30.63.19 peer 10.30.63.18