Mypower
S4100
Troubleshooting
Maipu Confidential & Proprietary Information
Page
81
of
124
the device and the
authentication server
are different
shared key, they can exchange the correct authentication
packets. Check whether the shared keys of the device and the
server are the same. If not, change them into the same value.
2.
The AAA
authentication is not
enabled
Run the show aaa config command to check whether the “aaa
new-model aaa authentication connection default radius” is
enabled. If not, enable it before login for authentication.
3.
AAA service is
abnormal or the
standalone AAA server
is not configured with
client information
Check whether the authentication process is running in the AAA
server. You can also use the netstat –an –p udp command in
the cmd interface to check whether the ports 1645 and 1812
provide services. If not, restart the service.
4.
Run more than one
AAA server on a PC
server
Check the service process and close other AAA servers. Ensure
only the correct server is running.
5.
On the Ps server, the
user is in the disabled
status or the user
time access control is
improperly configured.
On the Ps server, check whether the user is disabled. If
disabled, enable the user. Check whether the user access
control time segment and the ps time match.
6.
The dot1x
authentication is not
enabled at the port.
Use the show run port x/x command to check whether the
dot1x port-control enable configuration is available. If not, add
the configuration at the port.
7.
The eap-relay function
is enabled.
The AAA server on the PS does not support the eap-relay
function. Use the show run port x/x to check whether the dot1x
eap-relay enable configuration is available. If yes, delete the
configuration.
8.
The mac vlan is not
enabled at the port
When the ps binds vlan for roles, the user delivers vlan and
joins the vlan in the mac-vlan mode when the user logs in for
authentication. If the port is not enabled, the authentication will
fail. Use the show run port x/x command to check whether the
mac-vlan enable configuration information is available. If not,
add the configuration.
9.
The vlan bound with
the role of the user
does not exist or is
the dynamic vlan
learned through the
gvrp.
Check whether the vlan id to be delivered exists on the device.
If the existing vlan is dynamic vlan, add the static vlan on the
device.
10.
The network segment
bound with the role of
the user and the client
IP are not in the same
network segment.
The client IP address and role network do not match, thus, it
cannot be launched. Check the address bound with the role on
ps. At the same time, check the NIC IP address at the client and
ensure that they are in the same network segment.
11.
After the
authentication, the
client and the ps
server are not
connected.
There is no certificate confirmation information in the first login
or the client cannot ping the server. You need to check the
device configuration. If the client and the server are through L3,
check the router. If they are through L2, ensure they are in the
same vlan.
12.
On the PS, the bound
IP address, port, or
MAC address is
incorrect.
The information bound on the PS and the information on the
client does not match. As a result, the login fails. Check the
configuration to ensure that the bound information is correct.
13.
Between the client
and the authentication
device, the switch is
used but not
configured with eapol-
relay function.
Check whether the switch supports the dot1x transparent
transmission function. If yes, whether the transparent
transmission function is configured. If not, configure the switch
accordingly.
