某局點S7506X-G portal認證頻繁上下線

S7506X-G portal認證頻繁上下線

1、終端portal認證成功後，立馬就掉了，配置暫無問題。

2、查看debug信息可以看到，交互完radius報文後，交換機發送了：
Portal sent 46 bytes of packet: Type=ack_auth(4), ErrCode=0, IP=192.168.x.x
*Dec 16 06:06:16:205 2024 SW-CORE PORTAL/7/PACKET:
[ 11 SESSIONID           ] [  8] [000e-xxxx-xxxx]
[ 10 BASIP               ] [  6] [192.168.x.x]

3、然後服務器回：
Portal received 32 bytes of packet: Type=aff_ack_auth(7), ErrCode=0, IP=192.168.x.x
*Dec 16 06:06:16:400 2024 SW-CORE PORTAL/7/PACKET:
02 07 01 00 31 a1 00 00 c0 a8 32 01 00 00 00 00
38 bc 63 00 64 de 82 ee 58 e6 98 5c 8d 28 a6 18
說明此時認證完成結束了。

但是緊接著，交換機發了logout報文，導致認證用戶下線：
*Dec 16 06:06:16:403 2024 SW-CORE PORTAL/7/PACKET:
Portal sent 63 bytes of packet: Type=ntf_logout(8), ErrCode=0, IP=192.168.x.x
*Dec 16 06:06:16:403 2024 SW-CORE PORTAL/7/PACKET:
[  5 TEXTINFO            ] [ 25] [Failed to set user rule]
[ 10 BASIP               ] [  6] [192.168.x.x]

4、服務器側報錯：

5、debug發送下線報文的原因是Failed to set user rule，一般是acl資源不足或者是AAA服務器下發而設備不能正常執行的授權規則導致的acl資源我看過是足夠的，懷疑是aaa那邊下發了設備無法執行的授權規則。但是後續將domain域裏的授權改為none了之後故障依舊。

6、debug報錯，底層acl規則不支持匹配聚合：

*Dec 16 06:06:16:403 2024 SW-CORE PORTAL/7/RULE: 

 DRV_USER_RULE:

   L2 Interface     = Bridge-Aggregation99

    L3 Interface     = Vlan-interface50

    VLAN             = 50

    SrcIP            = 192.168.x.x

    SrcMAC           = 000e-xxxx-xxxx

    AuthorACL        = 4294967295

    Operation        = 1

    SetDrvFlag       = 0

    TrafficLevelNum  = 0

    TrafficLevelMap  = 0x0

    TrafficActiOnMap= 0x0

    UserID           = 268437813

    VrfIndex         = 0

    AclMismatchAction= 0

    MicroSegmentID   = 0

*Dec 16 06:06:16:403 2024 SW-CORE PORTAL/7/EVENT: Start scanning traffic send work.

*Dec 16 06:06:16:403 2024 SW-CORE PORTAL/7/EVENT: Send packet thread message cache timer callback : cnt 1.

*Dec 16 06:06:16:403 2024 SW-CORE PORTAL/7/EVENT: Send packet thread begins processing queue message.

*Dec 16 06:06:16:403 2024 SW-CORE PORTAL/7/EVENT: Send packet thread list is not empty.

*Dec 16 06:06:16:403 2024 SW-CORE PORTAL/7/PACKET: 

Portal sent 63 bytes of packet: Type=ntf_logout(8), ErrCode=0, IP=192.168.x.x

*Dec 16 06:06:16:403 2024 SW-CORE PORTAL/7/PACKET: 

[  5 TEXTINFO            ] [ 25] [Failed to set user rule]

[ 10 BASIP               ] [  6] [192.168.x.x]

開啟portal用戶漫遊功能，聚合口開啟portal roaming enable功能後問題解決。