To address the issue, Huawei performed the following operations and observed the following information:
1. Checked the user table entry and found that the user was in the pre-authentication domain when it failed to access the Internet.
2. Analyzed the authentication process. Based on the Web authentication process of ME60, ME60 sends the packet of authenticated ACK_AUTH to the Portal server after receiving the message of successful authentication from RADIUS server. Meanwhile, the ME60 starts a timer of 30 seconds and wait for the Portal server to respond the AFF_ACK_AUTH packet. If ME60 does not receive the AFF_ACK_AUTH packet from the Portal server in 30 seconds, it sends a logout message to the Portal server and forces users to go offline.
3. Based on the Trace access-user information, the RequestID of AFF_ACK_AUTH packet that returned from the Portal server was 0. The RequestID of ACK_AUTH packet that ME60 sent was 1184. As a result, the ME60 could not match the message. After 30 seconds, the user went offline. For details, see the attachment. Type of ACK_AUTH was authentication ack and Type of AFF_ACK_AUTH was ack of authentication ack.5. Modified related configuration on the portal server to resolve this problem.