Avaya WLAN Security Switch 2300 Series, Руководство по устранению неполадок и отладке, Страница: 21 / 74

21
Avaya WLAN Security Switch 2300 Series Troubleshooting and Debug Guide
Enable “long preamble” in the Radio Profile.
Disable “WMM” in the Radio Profile
Set the radio-type to be 802.11b instead of 802.11g
If you can see that we are sending packets and the radius server isn’t accepting them, see if the
customer will install Ethereal on the radius server or hook up an Ethernet sniffer directly in front of
the radius server. If the packets leave the WSS and don’t arrive at the radius server it’s some sort of
routing issue (check ip route table on the WSS and have customer check intermediate routers). If
the packets are arriving at the radius server and it’s not acknowledging them, have the customer
check the “radius client” configuration and the shared secret (again). If the shared secret is incorrect,
or the client is not defined, Microsoft IAS will silently discard the packet.
If you see a “Status:FAIL from AAA” message in the trace log, then it means that the client failed
authentication and the certificate or username/password is invalid. Check the log files on the Radius
server for more information, and the client configuration. If you don’t see anything in the log files on
the Radius server, then double-check the shared secret configured for the radius server (both on the
WSS and on the radius server). You can also turn on radius tracing to see a decode of the packets
we are sending to radius.
If you see an authorization failure, one of the radius attributes is incorrect, not present, or the VLAN
the user is configured for is not available. The system log message should indicate which attribute is
present, and what it is configured for. Go through the configuration to find out if it’s configured. Pay
close attention to the capitalization of the attribute because the system used to be case-sensitive
and there may still be some areas which still are.
If you see “excessive retransmits, deleting client” then something is not configured properly in the
client. This means that the client is not answering 802.1X queries at some point. Review that section
of the trace log and determine what part of the authentication you are in. If this is at the very
beginning (identity requests) then have the customer check the basic configuration on the client and
look for 3
rd
party dot1x supplicants like AEGIS. These can be installed by default with the NIC’s
management programs. Check the properties of the NIC where it lists protocols (like TCP/IP and
“Client for Microsoft Networks”) and uncheck any unfamiliar looking items. Also check to be sure that
the client has the appropriate CA certificate and that all certificates involved haven’t expired.
Switch stability
Typical symptoms:
All DAPs on a switch rebooting simultaneously
“Core” files other than command_audit.cur” showing in the output of “dir”
Sluggish CLI and occasional missed ping responses.
Troubleshooting Steps: