Slot-1: Authentication failed for Network Login MAC user

[holden]

Hi,

We have a strange issue on one of our Switches which are using mac-based netlogin with vendor tag for the VLAN and radius:

• many Mac-Adresses can authenticate successfully to this Switch, some Mac-Adresses can not
• The Mac-Adresses that can not authenticate, can authenticate on other Switches
• The Mac-Adresses can not authenticate on any port, where other Mac-Adresses can authenticate.
• The Configuration was not modified and had worked all the time properly
• The Devices are connected on a ReachNxt through Fiber
• I can see in the Radius logs that the authentication was State success
• The Issue is VLAN independent
• If the Netlogin assigns one VLAN to the Port, no other Mac-Adresses can authenticate

How can i debug this issue on EXOS Side?

Is there any debug command which Shows me all Information about the processing?

Thanks in Advance!

[holden]

Thanks,

the logs also Shows Code 2 but afterwards athentication failed:

04/03/2017 10:32:27.47 Slot-1: Authentication failed for Network Login MAC user 000E8CEB8325 Mac 00:0E:8C:EB:83:25 port 1:23
04/03/2017 10:32:27.47 Slot-1: _aaaRespondToClient-: sent message to client:peer 13
04/03/2017 10:32:27.47 Slot-1: _aaaRespondToClient- :Peer 13
04/03/2017 10:32:27.47 Slot-1: _aaaRequestDequeue-: remove and dequeue peer request 13, count 0
04/03/2017 10:32:27.46 Slot-1: RADIUS:Got a reply, code 2, length 83
04/03/2017 10:32:27.46 Slot-1: Radius Packet ID 161 returned
04/03/2017 10:32:27.46 Slot-1: __aaaReqFindRadiusInQueue-:found by pktId 161 authMethod 2

What can be the issue?

Thanks in advance.

[Chacko]

Hi,

the switch received an acces-access packet (reply code 2).
Is there maybe a MAC-lock defined on the port? Or a restriction, that only one-mac is permitted?
Do you use the NAC-Appliances by ExtremeNetworks as a radius-server or another product?
Is every switch at your site configured to contact the same radius-server?

Best Regards
Chacko

[OscarK]

Hello, you can enable extra logging for radius/netlogin, that will provide you with the reasons probably.
Below an article describing how to do this.
https://gtacknowledge.extremenetworks.com/articles/How_To/How-to-enable-additional-debug-logs-in-EXO...