Mypower
S4100
Troubleshooting
Maipu Confidential & Proprietary Information
Page
38
of
124
Common 802.1x Troubleshooting
Fault 1: The client prompts authentication error, the wrong authentication
type does not pass the authentication.
Possible Reasons
Judging Methods and Solutions
The share keys set on the
device and the
authentication server are
inconsistent.
When the device and the authentication server have the same
share key, they can exchange correct authentication packets.
View whether the share keys on the device and the server are
consistent. If not, change them to be consistent.
The AAA authentication is
not enabled on the device.
Use the show run command to view whether aaa new-
model is enabled on the device. If not, enable it. Besides, if it
is radius authentication, you need to configure aaa
authentication connection default radius; if it is the local
authentication, configure aaa authentication connection
default local. Meanwhile, for the local authentication, you
also need to configure the user name and password.
The network between the
device and the server fails.
When the device sends the radius/TA CACS packets, the
response cannot be received from the peer. Here, you can
view the network connection between them (you can use ping
to check whether the route is reachable).
Fault 2: The accounting cannot be performed normally on the server.
Possible Reasons
Judging Methods and Solutions
The AAA accounting is not
enabled on the device.
Use the show run command to view whether aaa
accounting connection default start-stop radius
accounting parameter is enabled on the device. If not, enable it
and then re-account.
Fault 3: When TACACS authentication is enabled, using the correct user
name and password times out and the authentication fails.
Possible Reasons
Judging Methods and Solutions
The device works in the EAP
relay mode.
The TACACS server cannot identify the EAP packets, so if the
device works in the EAP relay mode, the authentication cannot
pass. Execute the eap-relay disable command on the port
and then perform the dialup authentication.
Fault 4: After the first authentication fails, you cannot perform the later
authentication at once. You need to wait for some time and then you can
continue to respond to the authentication.
Possible Reasons
Judging Methods and Solutions
By default, maximum
authentication failure times
of the system is 1.
The default maximum authentication failure times of the
system is 1, so when the first authentication fails, the system
needs to wait for one punish time, and then can continue to
respond to the later authentication. To solve the problem, you
can use the dot1x max-authfail and dot1x timeout quiet-
period commands to modify the maximum authentication
