[Troubleshooting Series] Case 4 Users Who Have Passed MAC Address Authentication Frequently Go Offline After Going Online Highlighted

Latest reply: Dec 29, 2018 09:43:24 419 9 1 1

Users Who Have Passed MAC Address Authentication Frequently Go Offline After Going Online

Network Topology

Physical Network Topology

Figure 1-1 Network where a offline failure occurs

141526zxqlek5rr5gtr5re.png

 

Fault Description

MAC address authentication is applied to access devices. When a user goes online after passing MAC address authentication, the user goes offline in a while. The process repeated frequently.

Configuration Files

#LSW

!Software Version V200R010C00SPC600
#
sysname LSW
#
vlan batch 10 20 64 to 95 100 to 101 220
#
authentication-profile name default_authen_profile
authentication-profile name dot1x_authen_profile
authentication-profile name mac_authen_profile
authentication-profile name portal_authen_profile
authentication-profile name dot1xmac_authen_profile
authentication-profile name multi_authen_profile
authentication-profile name p1
 mac-access-profile m1
 authentication timer handshake-period 10
 access-domain huawei.com force
#
lldp enable
#
clock timezone 2 add 01:00:00
#
dhcp enable
#
portal-access-profile name portal_access_profile
#
aaa
 authentication-scheme default
 authentication-scheme radius             
  authentication-mode radius
 authentication-scheme a1
 authorization-scheme default
 authorization-scheme b1
 accounting-scheme default
 local-aaa-user password policy administrator
  password expire 0
 domain default
  authentication-scheme radius
  radius-server default
 domain default_admin
  authentication-scheme default
 domain huawei.com
  authentication-scheme a1
  radius-server default
 local-user admin password irreversible-cipher $1a$5~<kV.#apT$W/fbBDHC(EM,,p"KYo~DDpZ6#[,_z5@ArLH+(8J~$
 local-user admin privilege level 15
 local-user admin service-type telnet terminal ssh http
 local-user huawei password cipher %^%#XlvE#{2tjDXt@}@l1PDPQcCt3f]spQC1Ba)c,eST%^%#
 local-user huawei privilege level 0
 local-user huawei service-type 8021x
#
interface Vlanif220
 ip address 10.220.7.25 255.255.254.0
#
interface MEth0/0/1
#
interface GigabitEthernet0/0/14
 port link-type trunk
 undo port trunk allow-pass vlan 1
 port trunk allow-pass vlan 64 to 95
 authentication-profile p1
#
interface GigabitEthernet0/0/15
 port link-type access
 port default vlan 10
 authentication-profile p1
#
interface NULL0
#
arp static 10.220.7.30 38bc-0196-c308 vid 220 interface GigabitEthernet0/0/7
#
ip route-static 0.0.0.0 0.0.0.0 10.220.6.1
#
stelnet server enable
ssh user admin
ssh user admin authentication-type password
ssh user admin service-type stelnet
ssh client first-time enable
ssh client 10.220.6.1 assign ecc-key 10.220.6.1
ssh client 10.220.7.26 assign rsa-key 10.220.7.26
ssh client 10.220.7.27 assign dsa-key 10.220.7.27
ssh client 10.220.7.30 assign dsa-key 10.220.7.30
ssh client 10.220.7.61 assign dsa-key 10.220.7.61
#
user-interface con 0                      
 authentication-mode aaa
user-interface vty 0 4
 authentication-mode aaa
user-interface vty 16 20
#
dot1x-access-profile name dot1x_access_profile
#
mac-access-profile name mac_access_profile
mac-access-profile name m1
 mac-authen username fixed Huawei password cipher %^%#U>wXOHlE"*m@@~UcsJF9,fbeIKBq4AW19.AG'qf3%^%#
#
return

Troubleshooting Location

Troubleshooting Procedure

                               Step 1      Obtain the MAC address of the offline PC, go to Step 2.

                               Step 2      Check the information about  logout record.

Run the display aaa command in any view of the device to view the information about time when a user goes online and offline, reason why a user fails to go offline.

[LSW] display aaa offline-record mac-address f0de-f162-bee4
  ------------------------------------------------------------------------------
  User name             : vlan-test
  Domain name           : default
  User MAC              : f0de-f162-bee4
  User access type      : 802.1x
  User access interface : GigabitEthernet0/0/15
  Qinq vlan/User vlan   : 0/42
  User IP address       : 192.168.42.254
  User ID               : 25
  User login time       : 2018/01/06 17:24:20
  User offline time     : 2018/01/06 17:24:29
  User offline reason   : ARP detect fail

The interval between user online and offline is 10s, and the reason why a user fails to go offline is ARP dectect fail, go to Step 2.

                               Step 3      Check the handshake interval of the device with authorized users.

Run the display authentication-profile configuration command to check whether the  handshake interval is equal to the interval between user online and offline.

<LSW> display authentication-profile configuration name p1
  Profile name                                : p1
  Dot1x access profile name                   : -
  Mac access profile name                     : -
  Portal access profile name                  : testdel
  Free rule template                          : -
  Force domain                                : -
  Dot1x force domain                          : -
  Mac-authen force domain                     : -
  Portal force domain                         : -
  Default domain                              : 110
  Dot1x default domain                        : -
  Mac-authen default domain                   : -
  Portal default domain                       : -
  Permit domain                               : -
  Authentication handshake                    : Enable
  Authentication handshake period             : 10s    
  Auth-fail re-auth period                    : 60s
  Pre-auth Re-auth period                     : 60s
  Auth-fail aging time                        : 82800s
  Pre-auth aging time                         : 82800s
...

After all, we can be sure that the PC goes offline because the PC does not respond with ARP reply packets or ND reply packets during the period when the handshake with authorized users is enabled. The device will log the PC out unexpectedly, go to Step 4.

                               Step 4      Capture packets on the client interface to check whether the client responds to the ARP probe packets sent from the device and whether the source IP address of the ARP probe packets is 255.255.255.255 (it is optional, and the default value is 255.255.255.255.). So the PC cannot respond to an ARP probe packet with the source IP address 255.255.255.255.

Solution:

1.         Specify a source IP address for the offline detection packet, the user gateway IP address and its corresponding MAC address as the source IP address and source MAC address of offline detection packets is advitsed to specify.

[LSW] access-user arp-detect vlan 10 ip-address 192.168.1.1 mac-address 2222-1111-1234

2.         Set the default source IP address of offline detection packets to 0.0.0.0.

[LSW] access-user arp-detect default ip-address 0.0.0.0

----End

Root Cause

The device sends an ARP probe packet to check the user online status. If the user does not respond within a detection period, the device considers that the user is offline.

If the VLAN to which the user belongs does not have a VLANIF interface or the VLANIF interface does not have an IP address, the device sends an offline detection packet using 255.255.255.255 as the source IP address. If a user cannot respond to an ARP probe packet with the source IP address 255.255.255.255, the device will log the PC out unexpectedly.


  • x
  • convention:

EdeninRealMadrid
Created Dec 11, 2018 18:04:03 Helpful(0) Helpful(0)

It's useful
  • x
  • convention:

jomos
Created Dec 11, 2018 18:08:05 Helpful(0) Helpful(0)

Nice huawei
  • x
  • convention:

Hawasli
Created Dec 11, 2018 18:20:51 Helpful(0) Helpful(0)

Need more tools
  • x
  • convention:

EdeninRealMadrid
Created Dec 12, 2018 07:11:05 Helpful(0) Helpful(0)

Thanks you
  • x
  • convention:

jomos
Created Dec 12, 2018 07:17:14 Helpful(0) Helpful(0)

Nice
  • x
  • convention:

jomana
Created Dec 12, 2018 07:25:10 Helpful(0) Helpful(0)

Its useful
  • x
  • convention:

Hawasli
Created Dec 12, 2018 08:39:32 Helpful(0) Helpful(0)

Need more information
  • x
  • convention:

jomos
Created Dec 12, 2018 09:32:56 Helpful(0) Helpful(0)

Nice
  • x
  • convention:

chouhao
Created Dec 29, 2018 09:43:24 Helpful(0) Helpful(0)

The device sends an ARP probe packet to check the user online status. If the user does not respond within a detection period, the device considers that the user is offline.

If the VLAN to which the user belongs does not have a VLANIF interface or the VLANIF interface does not have an IP address, the device sends an offline detection packet using 255.255.255.255 as the source IP address. If a user cannot respond to an ARP probe packet with the source IP address 255.255.255.255, the device will log the PC out unexpectedly.
  • x
  • convention:

Reply

Reply
You need to log in to reply to the post Login | Register

Notice Notice: To protect the legitimate rights and interests of you, the community, and third parties, do not release content that may bring legal risks to all parties, including but are not limited to the following:
  • Politically sensitive content
  • Content concerning pornography, gambling, and drug abuse
  • Content that may disclose or infringe upon others ' commercial secrets, intellectual properties, including trade marks, copyrights, and patents, and personal privacy
Do not share your account and password with others. All operations performed using your account will be regarded as your own actions and all consequences arising therefrom will be borne by you. For details, see " Privacy."
If the attachment button is not available, update the Adobe Flash Player to the latest version!
Login and enjoy all the member benefits

Login and enjoy all the member benefits

Login