Fault Analysis
1.
Run the
display trapbuffer
and
display logbuffer
commands on Router B to check
whether a trap or a log indicating that users are forced offline is recorded. The following
trap information is displayed:
AAA cut user!
2.
Run the
display current-configuration
command on Router B to check the AAA
configuration. The command output shows that local authentication and RADIUS
accounting are adopted. Details are as follows:
radius-server template provera
radius-server shared-key simple 123456
radius-server authentication 129.7.66.66 1812
radius-server accounting 129.7.66.66 1813
undo radius-server user-name domain-included
#
aaa
local-user telenor password simple 123456
authentication-scheme default
#
authentication-scheme provera
authentication-mode radius local
#
authorization-scheme default
#
accounting-scheme default
accounting-scheme provera
accounting-mode radius
accounting realtime 10
#
domain default
#
domain huawei
authentication-scheme provera
accounting-scheme provera
radius-server provera
#
user-interface vty 0 4
authentication-mode aaa
user privilege level 15
set authentication password simple 123456
history-command max-size 256
screen-length 15
Because the RADIUS server is unavailable, real-time accounting fails. You can run the
accounting interim-fail
command to configure a real-time accounting failure policy to
determine whether to keep users online or force them offline after the real-time accounting
fails. If the
accounting interim-fail
command is not configured, Router B adopts the
default setting to force users offline when real-time accounting fails.
It can therefore be concluded that RADIUS accounting failure causes users to be forced
offline. The period after which login users are forced offline is determined by the
retransmission timeout period and retransmission times, which are configured by using the
radius-server
{
retransmit
retry-times
|
timeout
time-value
}
*
command. By default, data
is retransmitted every 5 seconds for three consecutive times. If data fails to be retransmitted
15 seconds after login, users are forced offline.
Procedure
Step 1
Run the
system-view
command to enter the system view.
Step 2
Run the
aaa
command to enter the AAA view.
Huawei AR2200-S Series Enterprise Routers
Troubleshooting
10 Security
Issue 01 (2012-01-06)
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
279
