Avaya 3524gt Troubleshooting Manual Download Page 60 | Manualshive

Page: 60 / 88

Avaya 3524gt Troubleshooting Manual Download Page 60

EAP client authentication

This section provides troubleshooting guidelines for the EAP and non-EAP features on the
Ethernet Routing Switch 3500 Series devices.

Work flow EAP client is not authenticating

The following work flow assists you to determine the cause and solution of an EAP client that
does not authenticate as expected.

Troubleshooting authentication

60 Troubleshooting

March 2013

Comments? [email protected]

«
...
58
59
60
61
62
...
»

Summary of Contents for 3524gt

Page 1: ...Avaya Ethernet Routing Switch 3500 Series Troubleshooting 5 0 NN47203 700 Issue 01 02 March 2013...

Page 2: ...der documentation does not expressly identify a license type the applicable license will be a Designated System License The applicable number of licenses and units of capacity for which the license is...

Page 3: ...e any license or right in and to the Marks without the express written permission of Avaya or the applicable third party Avaya is a registered trademark of Avaya Inc All non Avaya trademarks are the p...

Page 4: ...4 Troubleshooting March 2013 Comments infodev avaya com...

Page 5: ...a knowledge and solution engine 23 Chapter 6 General diagnostic tools 25 ACLI command modes 25 Chapter 7 Initial troubleshooting 27 Gather information 27 Chapter 8 Emergency recovery trees 29 Emergenc...

Page 6: ...on issue 67 Match EAP MAC MAX to EAP users 68 Set EAPOL request packet 69 EAP RADIUS VLAN is not being applied 70 Configure VLAN at RADIUS 71 Configure switch 73 Configured MAC is not authenticating 7...

Page 7: ...Chapter 1 Purpose of this document This document describes common problems and error messages and the techniques to resolve them Troubleshooting March 2013 7...

Page 8: ...Purpose of this document 8 Troubleshooting March 2013 Comments infodev avaya com...

Page 9: ...All switches support autopolarity Table 1 Hardware Hardware Description Switch models AL3500 01 E6 3526T 24 10 100BaseT ports supporting autosensing and autonegotiation in a non PoE plus two 10 100 10...

Page 10: ...y side and mount them in a 19 inch rack AL3511003 E6 3510 Single Rack Mount Kit this kit is used to mount a single ERS 3510GT or ERS 3510GT PWR switch in a standard 19 inch rack ERS 3500 software feat...

Page 11: ...cript Auto save Disable Telnet up to four sessions Telnet out ability to open Telnet sessions from the box Domain Name Service DNS capability 256 port based VLANs with IVL VLAN 1 is the default manage...

Page 12: ...guration Syslog Dual Syslog servers ASCII Config Generator ACG 802 1X EAP SHSA MHMA MHSA Guest VLAN Non EAP RADIUS MAC 802 1X Enhancement Dynamic VLAN assignment for NEAP MHMA 802 1X Enhancement Unica...

Page 13: ...zation features Identify Units Blink LEDs Cumulative system uptime hidden command Virtual LACP Static Routing with default route IP Local and Non Local static routing BootP DHCP Relay Proxy ARP UDP fo...

Page 14: ...New in this release 14 Troubleshooting March 2013 Comments infodev avaya com...

Page 15: ...etworks ethernet bridging and IP routing Are familiar with networking concepts and terminology Have experience with Graphical User Interface GUI Have basic knowledge of network topologies Troubleshoot...

Page 16: ...Introduction 16 Troubleshooting March 2013 Comments infodev avaya com...

Page 17: ...ow your devices are connected logically and physically with virtual local area networks VLAN Maintain online and paper copies of your device configuration information Ensure that all online data is st...

Page 18: ...me sufficient to allow you to obtain statistics and data to see patterns in the traffic flow such as which devices are typically accessed or when peak usage times occur Use a baseline analysis as an i...

Page 19: ...alyze packet traffic the packet traffic is uninterrupted and packets flow normally through the mirrored port Port mirroring limitations The Ethernet Routing Switch 3500 Series supports port mirroring...

Page 20: ...s on your management workstation The daemon syslogd is a software component that receives and locally logs displays prints or forwards messages that originate from sources that are internal and extern...

Page 21: ...ary goal of the ASCII Configurator Generator ACG is to provide the users of the Ethernet Routing Switch 3500 Series with a tool that lets them easily modify the configuration of a particular switch AC...

Page 22: ...l provides a generic mechanism for the trap generation control that works with any trap type For more information see Avaya Ethernet Routing Switch 3500 Series Configuration Security NN47203 504 SNMP...

Page 23: ...nts see Avaya Ethernet Routing Switch 3500 Series Configuration System Monitoring NN47203 501 Avaya knowledge and solution engine The Knowledge and Solution Engine is a database of Avaya technical doc...

Page 24: ...Troubleshooting fundamentals 24 Troubleshooting March 2013 Comments infodev avaya com...

Page 25: ...privileges User EXEC Privileged EXEC Global configuration Interface configuration Each mode provides a specific set of commands The command set of a higher privilege mode is a superset of a lower priv...

Page 26: ...mode In the Interface Configuration mode also referred to as config if mode you can configure parameters for each port or VLAN such as speed duplex mode and rate limiting It is possible to move betwee...

Page 27: ...on of the switch To obtain this information use the show running config command System status Obtain this information using the show sys info command Output from the command displays technical informa...

Page 28: ...information When connectivity problems occur get information on at least five working source and destination IP pairs and five IP pairs with connectivity issues To obtain this information use the foll...

Page 29: ...covery Emergency recovery trees The following work flow shows the ERTs included in this section Each ERT describes steps to correct a specific issue the ERTs are not dependant upon each other Figure 1...

Page 30: ...y Recovery Tree see Locating the switch console ports on page 36 Using the Diagnostics Menu on page 37 Corruption of flash recovery tree Figure 2 Corruption of flash recovery tree Emergency recovery t...

Page 31: ...g VLAN If the server is defined as a port based VLAN with a VLAN ID of 3 and the PVID of the port is 2 then loss of communication can occur This can be verified by checking that the PVID of the ports...

Page 32: ...switch and devices in a VLAN on the ERS 8600 series switch are not able to communicate with devices at the ERS 3500 series switch in the same VLAN then it is likely that the uplink ports are not tagge...

Page 33: ...pecific VLAN When an untagged frame exits the switch through a tagged member port the frame header changes to include the 32 bit tag associated with the ingress port PVID When a tagged frame exits the...

Page 34: ...Uplink ports not tagged to VLAN recovery tree Figure 4 Uplink ports not tagged to VLAN recovery tree Emergency recovery trees 34 Troubleshooting March 2013 Comments infodev avaya com...

Page 35: ...e the switch will report an error such as Agent code verification fails Units exhibiting the symptoms should NOT be returned through the Return Merchandise Authorization RMA For assistance with tasks...

Page 36: ...ree Figure 5 Agent Recovery Emergency Recovery Tree Locating the switch console ports The following figure identifies the ports on the ERS 3500 switches Emergency recovery trees 36 Troubleshooting Mar...

Page 37: ...ts POST are executed and the following is displayed Test 111 DDRAM Walking 1 0s PASSED Test 112 DDRAM Byte Word Long PASSED Test 113 DDRAM Power of 2 PASSED Test 121 ROM Config PASSED Test 151 FANs St...

Page 38: ...de Press e to display Errors Press i to initialize config flash Press p to run POST tests Press r to reset the box If you press Result a Diagnostics executes the Agent code if present Starting Agent V...

Page 39: ...g figure shows output from the show vlan interface info command Example VLAN Interface VLAN IDs The following figure provides example output from the show vlan interface vids command Example Checking...

Page 40: ...agging options Use the commands and outputs in this example to assist in adding missing VLANs to affected uplink ports Emergency recovery trees 40 Troubleshooting March 2013 Comments infodev avaya com...

Page 41: ...tion for hardware troubleshooting specific to the Ethernet Routing Switch 3500 Series Work flow Troubleshooting hardware The following work flow assists you to determine the solution for some common h...

Page 42: ...Figure 7 Troubleshooting hardware Troubleshooting hardware 42 Troubleshooting March 2013 Comments infodev avaya com...

Page 43: ...The following task flow assists you to confirm that the Ethernet Routing Switch 3500 Series device is powered correctly Figure 8 Check power Correcting voltage source Confirm the power cord is connec...

Page 44: ...eries device to eliminate corrupted or damaged code that causes a partial boot of the device Caution Ensure you have adequate backup of your configuration prior to reloading software Know the current...

Page 45: ...The following task flow assists you to check the port and ethernet cables Figure 9 Check port Viewing port information Review the port information to ensure that the port is enabled 1 Use the show int...

Page 46: ...1 Go to interface specific mode using the interface fastethernet port command 2 Use the no shutdown command to change the port configuration 3 Use the show interfaces port command to display the port...

Page 47: ...to display the port information 2 Note the port status Enabling the port Ensure the port on the Ethernet Routing Switch 3500 series device is enabled 1 Use the no shutdown command to change the port...

Page 48: ...w and adhere to all safety instructions and literature included with device and in Avaya Ethernet Routing Switch 3500 Series Regulatory Information NN47203 100 Verifying software version is correct on...

Page 49: ...ation of the failed unit to be replicated on the new unit 3 Confirm that the new unit has reset itself This confirms that replication has completed Returning unit for repair Return unit to Avaya for r...

Page 50: ...Troubleshooting hardware 50 Troubleshooting March 2013 Comments infodev avaya com...

Page 51: ...ry to set this VLAN as the ADAC voice VLAN using the command adac voice vlan x ADAC automatically creates the voice VLAN when needed You only have to reserve or set the VLAN number used by ADAC with t...

Page 52: ...llowing work flow assists you to resolve detection issues Figure 12 IP phone not detected Correct filtering Configure the VLAN filtering to allow ADAC Task flow Correct filtering The following task fl...

Page 53: ...ANs listed with the port Disabling the VLAN filtering of unregistered frames Change the unregistered frames filtering of the VLAN 1 Use the vlan ports port filter unregistered frames enable command to...

Page 54: ...1 Follow local procedures to disconnect the phone 2 Follow local procedures to reconnect the phone Disabling and enabling the port Disable ADAC on the port and then enable it to detect the phone When...

Page 55: ...ices on the system Figure 15 Reduce LLDP devices Viewing LLDP information Display the LLDP devices that are connected to a port 1 Use the show lldp port 1 neighbor command to identify the LLDP devices...

Page 56: ...t may interfere with auto configuration of devices Task flow Auto configuration is not applied The following task flow assists you to solve auto configuration issues Figure 16 Auto configuration is no...

Page 57: ...to configuration Figure 17 Correct auto configuration Viewing ADAC global status Display the global status of ADAC 1 Use the show adac command to display the ADAC information 2 Note if the oper state...

Page 58: ...rver and uplink port can assist the auto configuration 1 Use the adac uplink port port command to assign the uplink port 2 Use the adac call server port port command to assign the call server port Tro...

Page 59: ...and function The following work flow shows common authentication problems Work flow Troubleshooting authentication The following work flow shows typical authentication problems These work flows are n...

Page 60: ...n the Ethernet Routing Switch 3500 Series devices Work flow EAP client is not authenticating The following work flow assists you to determine the cause and solution of an EAP client that does not auth...

Page 61: ...Figure 19 EAP client is not authenticating Restore RADIUS connection Ensure that the RADIUS server has connectivity to the device EAP client authentication Troubleshooting March 2013 61...

Page 62: ...rver settings for the switch This section provides troubleshooting guidelines for obtaining the RADIUS server settings 1 Obtain network information for the RADIUS server from the Planning and Engineer...

Page 63: ...set the RADIUS server settings Reconfiguring the shared secret Reset the shared secret in case there was any corruption 1 Use the radius server key command 2 Refer to the vendor documentation for ser...

Page 64: ...tion for the PC and network card 2 Ensure the network card is enabled 3 Ensure the card is configured to support EAP Apply the method Ensure you apply the correct EAP method Task flow Apply the method...

Page 65: ...ion for the RADIUS Server from Planning and Engineering 2 Save the information for later reference Enable EAP globally Enable EAP globally on the 3500 Series device Task flow Enable EAP globally The f...

Page 66: ...o enable EAP globally on the 3500 Series device 2 Ensure that there are no errors after command execution Viewing EAPOL settings Review the EAPOL settings to ensure EAP is enabled 1 Use the show eapol...

Page 67: ...ommand execution EAP multihost repeated re authentication issue Eliminate the multiple authentication of users EAP multihost repeated re authentication issue The following work flow assists you to det...

Page 68: ...d max Obtain the exact number of EAP users that may soon enter when the number of authenticated users reaches the allowed max Use the show eapol multihost status command to display the authenticated u...

Page 69: ...OL request packet Change the request packet generation to unicast Task flow Set EAPOL request packet The following task flow assists you to set the EAPOL request packet to unicast Figure 26 Set EAPOL...

Page 70: ...ace Configuration mode 2 Use the eapol multihost eap packet mode unicast command to set the EAPOL request packet to unicast for the interface EAP RADIUS VLAN is not being applied Ensure that the RADIU...

Page 71: ...RADIUS Correct any discrepancies in VLAN information at the RADIUS server Task flow Configure VLAN at RADIUS The following task flow assists you to ensure the VLAN is configured at the RADIUS server E...

Page 72: ...n to locate server information 2 Obtain network information for the RADIUS server Viewing RADIUS information Obtain the radius information to identify its settings Use vendor documentation to obtain s...

Page 73: ...Type 802 Tunnel Pvt Group ID VLAN ID Tunnel Type Virtual LANs VLAN Configure switch The VLAN must be configured correctly on the Ethernet Routing Switch 3500 Series device Task flow Configure switch...

Page 74: ...interface information 1 Use the show eapol multihost interface port command to display the interface information 2 Note the status of ALLOW RADIUS VLANs Showing VLAN config control Display the VLAN c...

Page 75: ...ame STG Adding RADIUS assigned VLAN to desired STG Configure the VLAN that was assigned by RADIUS to correct Spanning Tree Group 1 Use the spanning tree stp 1 8 vlans command to make the change 2 Revi...

Page 76: ...sure the correct settings are applied to ensure the MAC is authenticating Task flow Configure the switch The following task flow assists you to ensure the MAC is authenticating on the ERS 3500 Series...

Page 77: ...lobally and that the port EAP status is set to auto Setting global EAP enabled and port at eap auto Make corrections to ensure that EAP is enabled globally and that the port EAP status is set to auto...

Page 78: ...erface port command to display the information 2 Ensure that Allow Non EAPOL clients is enabled 3 Ensure that the Multihost status is enabled Enabling multihost status and allow non EAPOL clients Corr...

Page 79: ...to add a MAC address to the list Non EAP RADIUS MAC not authenticating Correct a non EAP RADIUS MAC that is not authenticating Work flow Non EAP RADIUS MAC not authenticating The following work flow...

Page 80: ...ure the ERS 3500 Series device to correct the RADIUS MAC issue Figure 33 Configure switch Displaying EAPOL port Review the EAPOL port information 1 Enter the show eapol port port command to display th...

Page 81: ...ribute Format IpAddr MACAddr PortNumber Enabling RADIUS to authenticate non EAPOL clients Make the required changes to the password format on the RADIUS server Apply changes to the RADIUS server using...

Page 82: ...S server configuration error The following task flow assists you to configure the RADIUS server with the correct MAC and password Figure 34 RADIUS server configuration error Configuring MAC and passwo...

Page 83: ...assists you to determine the solution for an MHSA MAC that is not authenticating Figure 35 Non EAP MHSA MAC is not authenticating Configure switch Configure the switch to enable MHSA Task flow Configu...

Page 84: ...Figure 36 Configure switch Troubleshooting authentication 84 Troubleshooting March 2013 Comments infodev avaya com...

Page 85: ...sword format Use vendor documentation to make required changes on RADIUS server to change the format to IpAddr MACAddr PortNumber Enabling RADIUS to authenticate non EAPOL clients Make the required ch...

Page 86: ...The following work flow assists you to determine the solution for EAP non EAP ports experiencing a shutdown Figure 37 EAP non EAP unexpected port shutdown Configure switch Configure ports to allow mor...

Page 87: ...serve the log output and note any anomalies Showing EAP non EAP clients on port Display EAP non EAP client information on the port to provide additional information 1 Use the show mac address table co...

Page 88: ...provides troubleshooting guidelines for changing the EAP settings It assists in the cleanup of old MAC addresses 1 Use the eap force unauthorised command to set the administrative state of the port t...

Reviews:

No comments