Zte ZXR10 2900E series Configuration Manual page 292

ZXR10 2900E Series Configuration Guide
config nas
radius isp test defaultisp enable
radius isp test sharedsecret amtium
/*Shared key negotiated with company B*/
radius isp test add accounting 10.150.12.101
/*Address of the authentication and accounting server of company B*/
radius isp test add authentication 10.150.12.101
/*Address of the authentication and accounting server of company B*/
radius isp test client 172.16.0.181
/*ISP name and IP address accessing the switch*/
aaa-control port 1-24 dot1x enable
aaa-control port 1-24 accounting enable
aaa-control port 1-24 port-mode auto
When the configuration was completed, the authentication of some computers in B1, B2
and B3 timed out.
Fault Analysis
The students' accounts and configuration were correct, and the configuration of the ZXR10
2900E was correct. Even if ZTE's maintenance engineers replaced the faulty switch with
a new one, the problem still existed. The diagnosis result was that the interconnection
between devices of ZTE and company B was faulty.
By capturing packets, ZTE's maintenance engineers found that the ZXR10 2900E sent a
Radius Access Request message to the authentication and accounting server of company
B, but did not receive a response message. In normal circumstance, the Radius message
receiving and sending procedure is as follows:
1. When the server accesses the switch, the switch sends an Access Request message.
2. The server returns an Access Challenge message.
3. The switch sends an Access Request message again.
4. The server returns an Access Accept message.
5. The switch sends an Accounting Request message.
6. The server returns an Accounting Response message.
Because the authentication data packet flows captured on the two same ZXR10 2900E
devices were not the same, the diagnosis result was that the configuration of the
authentication and accounting server of company B was incorrect. Engineers of company
B checked alarms on the authentication and accounting server, and an alarm " AP not
support user auth type" was located. That is, authentication types of the server and
the switch were different. When the back-end configuration of the authentication and
accounting server was checked, it was found that the shared key on the switches of
buildings B1, B2 and B3 was set to "antium", but the negotiated key was "amtium".
7-8
SJ-20130731155059-002|2013-11-27 (R1.0) ZTE Proprietary and Confidential