下发神武连接服务器失败

知802.
1XRadius孔天娇2014-10-22发表S5120交换机与NPS服务器配合做802.
1x认证失败问题某客户使用我司交换机S5120结合NPS服务器做802.
1x认证,客户发现如果在NPS服务器上配置vlan下发,可以认证成功;取消vlan下发,则不能认证成功.
收集认证失败的debug信息Debugdot1xallDebugscallDebugradiuspacket分析认证报文交互过程*Sep105:33:12:1772014H3C5120-G5/5F-A1RDS/7/DEBUG:Receive:IP=[10.
1.
5.
248],Code=[2],Length=[368]*Sep105:33:12:1792014H3C5120-G5/5F-A1RDS/7/DEBUG:[8Framed-Address][6][255.
255.
255.
255][7Framed-Protocol][6][1][6Service-Type][6][2][65Tunnel-Medium-Type][6][6][64Tunnel-Type][6][13][79EAP-Message][6][030C0004]*Sep105:33:12:1802014H3C5120-G5/5F-A1RDS/7/DEBUG:[25Class][46][691306FD00000137000102000A0105F800000000000000000000000001CFC2F350F8FEBF000000000000002F][MS-26MS-CHAP2-Success][45][01533D32393933464535314235453744344139314432363539464143433641363039414636364631444142][MS-17MS-MPPE-Recv-Key][52][8008D75718C4F3EC4A03C74E2663928FFCF26C04AB299384AC5255C60D88CBF39F1EFAEE97D12AF784ADAD0CD3BFB084F407][80Message-Autheticator][18][431E003DC6A4239F561D6FB5E9F80669]*Sep105:33:12:1822014H3C5120-G5/5F-A1RDS/7/DEBUG:Info:RDreceivedMS-CHAP2-Success*Sep105:33:12:1832014H3C5120-G5/5F-A1RDS/7/DEBUG:Info:RDreceivedradiuskey,DecryptuserAuthenticatoris:*Sep105:33:12:1842014H3C5120-G5/5F-A1RDS/7/DEBUG:2a190000590000005a75000058150000*Sep105:33:12:1852014H3C5120-G5/5F-A1RDS/7/DEBUG:Info:DecryptMS-MPPE-Recv-Keywithradiusauthenauthenticatoris:*Sep105:33:12:1872014H3C5120-G5/5F-A1RDS/7/DEBUG:20750ec684dcee792040d06d0b7b70e3037d7e2b3c8303f93419468e32da9b541e000000000000000000000000000000*Sep105:33:12:1882014H3C5120-G5/5F-A1RDS/7/DEBUG:Reject,Message=[Vlanvaluethattheserverassignsisinvalid!
]*Sep105:33:12:1892014H3C5120-G5/5F-A18021X/7/EVENT:Auth:481,Msg:Authrequestackforfailure,ACM->1X.
*Sep105:33:12:1902014H3C5120-G5/5F-A18021X/7/EVENT:Port:GigabitEthernet1/0/26,Auth:481,ReceivedMsg:261,Currentstate:14*Sep105:33:12:1922014H3C5120-G5/5F-A18021X/7/EVENT:Auth:481,ProcessingnodeFAILURE.
.
.
从以上radius报文交互过程可以看到设备从NPS服务器侧收到认证响应报文,设备拒绝该报文,因为服务器分配的vlanid无效.
怀疑是服务器和设备的配合问题.
对比取消下发vlan和下发vlan服务器的响应报文:取消vlan下发:*Sep105:33:12:1772014H3C5120-G5/5F-A1RDS/7/DEBUG:Receive:IP=[10.
1.
5.
248],Code=[2],Length=[368]*Sep105:33:12:1792014H3C5120-G5/5F-A1RDS/7/DEBUG:[8Framed-Address][6][255.
255.
255.
255][7Framed-Protocol][6][1][6Service-Type][6][2][65Tunnel-Medium-Type][6][6][64Tunnel-Type][6][13][79EAP-Message][6][030C0004]*Sep105:33:12:1802014H3C5120-G5/5F-A1RDS/7/DEBUG:[25Class][46][691306FD00000137000102000A0105F800000000000000000000000001CFC2F350F8FEBF000000000000002F][MS-26MS-CHAP2-Success][45][01533D32393933464535314235453744344139314432363539464143433641363039414636364631444142][MS-17MS-MPPE-Recv-Key][52][8008D75718C4F3EC4A03C74E2663928FFCF26C04AB299384AC5255C60D88CBF39F1EFAEE97D12AF784ADAD0CD3BFB084F407][80Message-Autheticator][18][431E003DC6A4239F561D6FB5E9F80669]Vlan下发:*Sep105:37:53:6352014H3C5120-G5/5F-A1RDS/7/DEBUG:[64Tunnel-Type][6][13][65Tunnel-Medium-Type][6][6][81Tunnel_Private_Group_ID][4][3135][1User-name][46][host/Laptop-G56.
resourcepro0.
resourcepro.
com][32NAS-Identifier][18][H3C5120-G5/5F-A1][5NAS-Port][6][16883727]*Sep105:37:53:6362014H3C5120-G5/5F-A1RDS/7/DEBUG:[61NAS-Port-Type][6][15][31Caller-ID][16][373834352D633463352D30366462][40Acct-Status-Type][6][1][45Acct-Authentic][6][1][44Acct-Session-Id][15][1140801053720][4NAS-IP-Address][6][10.
1.
5.
131]*Sep105:37:53:6372014H3C5120-G5/5F-A1RDS/7/DEBUG:[55Event-Timestamp][6][1409549873][25Class][46][693B072500000137000102000A0105F800000000000000000000000001CFC2F350F8FEBF0000000000000057]查看服务器应答报文携带的属性发现虽然取消了vlan数值下发(81号属性),但在设备侧还是收到vlan下发属性(64、65号属性),但是这个值为空,导致设备无法识别.
报Vlanvaluethattheserverassignsisinvalid!
不下发vlan的情况下可以在服务器侧取消64、65、81属性下发.
[65Tunnel-Medium-Type][6][6][81Tunnel_Private_Group_ID][4][3135][64Tunnel-Type][6][13]取消64、65、81号属性下发.