某局點WX5540H 遠程portal無感知終端點擊下線後依舊在線問題處理經驗案例

AC結合IMC做遠程portal無感知，發現終端點擊下線後依舊在線：

查看用戶：

配置未發現異常，也沒有發現類似版本問題，開啟debugging portal all和debugging radius all，手動在終端認證頁麵點擊下線的流程如下：

*Jan  5 15:08:15:424 2024 H3C_AC01 PORTAL/7/EVENT: User-SM[172.X.X.X]: Received accounting-off response.

*Jan  5 15:08:15:424 2024 H3C_AC01 PORTAL/7/FSM: User-SM[172.X.X.X]: Begin to run.

*Jan  5 15:08:15:424 2024 H3C_AC01 PORTAL/7/FSM: User-SM [172.X.X.X]: State changed from Offline_Waiting_Acctoff to Done.

*Jan  5 15:08:15:424 2024 H3C_AC01 PORTAL/7/EVENT: User-SM[172.X.X.X]: Stopped User-SM timer.

*Jan  5 15:08:15:424 2024 H3C_AC01 PORTAL/7/FSM: User-SM[172.X.X.X]: User was destroyed.                       //手動在終端的認證頁麵點擊下線，終端下線成功 

Portal sent 46 bytes of packet: Type=ack_logout(6), ErrCode=0, IP=172.X.X.X                         //下線成功，AC向服務器發送終端下線報文

*Jan  5 15:08:15:425 2024 H3C_AC01 PORTAL/7/PACKET:

[ 11 SESSIONID           ] [  8] [XXXX-XXXX-XXXX]

 此時終端雖然下線了但是wifi並沒有斷開，終端自身的某些行為又觸發了無感知認證的流程：

*Jan  5 15:08:15:542 2024 H3C_AC01 PORTAL/7/MAC-trigger:                                   //觸發無感知流程

    MAC-trigger rule:

    InterfaceL3      = WLAN-BSS1/0/103

    InterfaceL2      = WLAN-BSS1/0/103

    VLAN             = 303

    SrcMAC           = XXXX-XXXX-XXXX

    SrcIP            = 172.X.X.X

*Jan  5 15:08:15:542 2024 H3C_AC01 PORTAL/7/MAC-trigger Event: Notify portal daemon new MAC-trigger entry successfully, SrcIP=172.X.X.X, SrcMAC=XXXX-XXXX-XXXX.

*Jan  5 15:08:15:542 2024 H3C_AC01 PORTAL/7/RULE:

 [Inbound] execute full rule match, { MatchRes = [Rule2-Deny] }

IfName = WLAN-BSS1/0/103, PortName = WLAN-BSS1/0/103, Vlan = 303, SrcMAC = XXXX-XXXX-XXXX,

 SrcIP = 172.X.X.X, DstIP = 40.X.X.X

 *Jan  5 15:08:15:543 2024 H3C_AC01 PORTAL/7/MAC-trigger Event: Received MAC overflow event, MAC=XXXX-XXXX-XXXX.    

*Jan  5 15:08:15:544 2024 H3C_AC01 PORTAL/7/EVENT: Success to get ssid by user mac, ssid:Client-Portal, user MAC:XX-XX-XX-XX-XX-XX.

*Jan  5 15:08:15:544 2024 H3C_AC01 PORTAL/7/PACKET:

Portal sent 55 bytes of packet: Type=req_macbind_info(48), ErrCode=0, IP=172.X.X.X             //AC向服務器發送mac綁定查詢報文

 *Jan  5 15:08:15:545 2024 H3C_AC01 PORTAL/7/MAC-trigger Event: MAC entry(XXXX-XXXX-XXXX) state changed from DEFAULT to WAIT, user IP = 172.X.X.X.

*Jan  5 15:08:15:546 2024 H3C_AC01 PORTAL/7/EVENT: Success to get info from wlan snooping, vlan:303. mac:XXXX-XXXX-XXXX,userip:172.X.X.X

*Jan  5 15:08:15:546 2024 H3C_AC01 PORTAL/7/EVENT: Success to get ifindex(1926) and vlan(303) from IPCIM, user IP=172.X.X.X,MAC=XXXX-XXXX-XXXX

*Jan  5 15:08:15:546 2024 H3C_AC01 PORTAL/7/PACKET:

Portal received 16 bytes of packet: Type=ack_macbind_info(49), ErrCode=0, IP=172.X.X.X                     // 服務器返回mac查詢結果  ErrCode等於0表示該MAC已在服務器綁定，可以走無感知上線

 *Jan  5 15:08:15:546 2024 H3C_AC01 PORTAL/7/MAC-trigger Event: MAC entry(XXXX-XXXX-XXXX) state changed from WAIT to BIND. user IP=172.X.X.X.           //無感知上線成功

現場AC結合IMC做的Portal無感知認證點了下線之後還在線並且還能正常上網是正常的，因為portal雖然下線了但是無線並沒有斷開，終端的一些行為會再次觸發無感知上線並正常上網

所以現場portal無感知場景終端上點擊下線不能使終端無法上網，可以從IMC上強製終端下線，IMC上應該可以同時清除無感知表項，終端再次上線就需要認證才能上線