Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document.
Note: Even the most advanced machine translation cannot match the quality of professional translators.
Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
Case Study: STA Authentication Fails Because the RADIUS Server Fails to Deliver ACL Authorization Policies
Symptom
802.1X authentication is configured on an AC, but STAs fail 802.1X authentication.
Relevant Alarms and Logs
None
Cause Analysis
The RADIUS server fails to deliver ACL authorization policies.
Procedure
- Reproduce the fault and use the trace and station-trace functions to check the authentication packet exchange process.
[AC] trace object mac-address sta-mac [AC] trace enable [AC-diagnose] station-trace sta-mac sta-mac
The command output indicates that the authorization ACL check fails.
[BTRACE][2020/08/07 11:40:29][1024][AAA][x-x-x]: AAA receive AAA_RD_MSG_AUTHENACCEPT message(50) from RADIUS module(235). [BTRACE][2020/08/07 11:40:29][1024][AAA][x-x-x]: CID:5973 TemplateNo:3 SerialNo:6040 SrcMsg:AAA_RD_MSG_AUTHENREQ ACLID:3000 [BTRACE][2020/08/07 11:40:29][1024][AAA][x-x-x]: [AAA ERROR]AAA check radius authen ack, check acl error! [BTRACE][2020/08/07 11:40:29][1024][AAA][x-x-x]:Radius authorization data error. [BTRACE][2020/08/07 11:40:29][1024][AAA][x-x-x]: [AAA ERROR]authen finish,the authen fail code is:16,reason is:Radius authorization data error.
- Run the display acl all command on the AC to check the ACL configuration. No information is displayed.
- Configure ACL 3000 on the AC. The problem is resolved.