Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document.
Note: Even the most advanced machine translation cannot match the quality of professional translators.
Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
Case Study: STA 802.1X Authentication Fails Because the Service VLAN Is Incorrectly Configured on the AC
Symptom
The STA fails to pass 802.1X authentication, and the PC does not prompt the user to enter the user name and password.
Relevant Alarms and Logs
None
Cause Analysis
The AC requires service VLAN encapsulation for 802.1X EAP packets from STAs, but the service VLAN is not correctly created on the AC.
Procedure
- Reproduce the fault and use the trace function to check the authentication packet exchange process. Only the EAPOL-Start packet is found, and the AC does not respond with the EAP-Request/Identity packet.
[AC] trace object mac-address sta-mac [AC] trace enable
- Use the packet obtaining tool to configure packet obtaining through bidirectional mirroring on the interface connecting the AC to the core switch.
Check the packets. It is found that the AC receives the EAPOL-Start packet but does not receive the EAP-Request packet.
- Use the debugging function on the AC to display the EAP packet forwarding process.
[AC-diagnose] debug cap print condition eap request [AC-diagnose] debug cap print condition dst-mac sta-mac
According to the command output, the switch cannot find the service VLAN.
- After the service VLAN is correctly created on the AC, the fault is rectified.
