Fault Symptom
A user needs to be authenticated by the Web authentication server through the device. After the configuration, the use can open the Web page and enter the user name and password. After that, the system prompts that the network access times out. User authentication thus fails.
Fault Analysis
1. Run the debugging web packet command in the user view to check information about Web authentication packets.
*1.1043515286 BRAS WEB/7/DEBUG:
packet received from socket( len = 65 Vrf = 0):
ver : 2
type : auth req
Method : pap
SerialNo: 1280
ReqID : 0
UserIP : 10.1.1.1
ErrCode : 0
AttrNum : 2
*1.1043515286 BRAS WEB/7/DEBUG:
02 03 01 00 05 00 00 00 76 76 a6 f3 00 00 00 02
d2 9f db 59 67 f1 9d 1c 68 5f ec 78 69 5a a6 22
02 08 31 31 31 31 31 31 01 19 64 78 31 74 40 77
6c 61 6e 2e 73 63 2e 63 68 6e 74 65 6c 2e 63 6f 6d
*1.1043515286 BRAS WEB/7/DEBUG:
*1.1043515385 BRAS WEB/7/DEBUG:
packet sent to socket( len = 32 Vrf = 0):
ver : 2
type : auth ack
Method : pap
SerialNo: 1280
ReqID : 0
UserIP : 10.1.1.1
ErrCode : 0
AttrNum : 0
*1.1043515385 BRAS WEB/7/DEBUG:
02 04 01 00 05 00 00 00 76 76 a6 f3 00 00 00 00
64 16 d9 a8 91 f7 29 22 63 19 37 c5 c7 4d f1 b1
*1.1043545315 BRAS WEB/7/DEBUG:
*1.1043545315 BRAS WEB/7/DEBUG:
*1.1043545315 BRAS WEB/7/DEBUG:
packet sent to socket( len = 32 Vrf = 0):
ver : 2
type : logout ntf
Method : pap
SerialNo: 0
ReqID : 0
UserIP : 10.1.1.1
ErrCode : 0
AttrNum : 0
*1.1043545315 BRAS WEB/7/DEBUG:
02 08 01 00 00 00 00 00 76 76 a6 f3 00 00 00 00
7b ec ab c0 c7 5d a8 66 00 e0 51 6b fa 64 66 ad
The command output shows that the device has sent an ACK packet indicating successful authentication to the Web authentication server but receives no response (type : logout ntf).
2. Check information on the firewall, and you can find that the source IP address of the ACK packet is the IP address of the upstream interface on the device. The Web authentication server, however, is configured to receive only packets with the IP address of the loopback interface on the device. This indicates that user authentication fails because the source IP address of packets sent by the device is incorrectly configured.
Procedure
1. Run the system-view command to enter the system view.
2. Run the web-auth-server source interface interface-type interface-number command configure the source interface on the device for sending packets to the Web authentication server to be the loopback interface on the device.
After the configuration, user authentication is successful.
Summary
If a user fails Web authentication through the device, you can check whether the IP address of the actual Web authentication server is the same IP address of the Web authentication server configured on the device. If the IP addresses are different, configure them to be the same.
