Case Study: The Portal Authentication Page Is Frequently Displayed on STAs Because the Heartbeat Interval Between the Portal Server and STAs Is Too Short

Symptom

Portal authentication is configured on the AC. After a STA passes authentication, the STA is automatically disconnected from the WLAN several minutes later and needs to be authenticated again.

Relevant Alarms and Logs

None

Cause Analysis

The heartbeat interval between the Portal server and STA is too short, and the Portal authentication success page is closed on the STA. As a result, the STA is forced to go offline.

Procedure

1. When an account is submitted for Portal authentication, check the causes of STA login failures and unexpected logouts.
   1. Run the display aaa online-fail-record mac-address mac-address command. The command output shows that the STA fails to go online because the authentication request is rejected by the RADIUS server.
   2. Run the display aaa abnormal-offline-record mac-address mac-address command. The command output shows that the STA goes offline unexpectedly because it requests to go offline (Web user request).
   3. Run the display access-user mac-address mac-address command. The command output shows that the STA is in pre-authentication domain state (pre-authen) when the Portal authentication page is displayed without entering the user name and password.

2. Use the trace function to check the STA authentication process.

   [AC] trace object mac-address sta-mac
   [AC] trace object ip-address sta-ip
   [AC] trace enable

   According to the command output, the STA goes offline because the Portal server sends a logout request to the AC.

   [BTRACE][2020/08/27 14:21:57][WEB][sta-ip]:Received packet from socket :
   Version         : 2
   Type            : logout request
   Method          : pap
   SerialNo        : 40
   RequestID       : 0
   UserIP          : sta-ip
   ErrorCode       : 0
   AttributeNumber : 2

3. On the Portal server, set the heartbeat interval between the Portal server and STAs to 4 hours or longer. Additionally, MAC address-prioritized Portal authentication is recommended.