Troubleshooting Portal; Inconsistent Keys On The Access Device And The Portal Server; Incorrect Server Port Number On The Access Device - HP 5500 HI Series Configuration Manual

S:Static
MAC ADDR
--------------------------------------------------------
0015-e9a6-7cfe
Total MAC VLAN address count:1
If a client fails authentication, it is added to VLAN 2. Use the previously mentioned commands to view the
assigned IP address and the generated MAC-VLAN entry for the client.

Troubleshooting portal

Inconsistent keys on the access device and the portal server

Symptom
When a user is forced to access the portal server, the portal server displays a blank Web page, rather
than the portal authentication page or an error message.
Analysis
The keys configured on the access device and the portal server are inconsistent, causing CHAP message
exchange failure. As a result, the portal server does not display the authentication page.
Solution
Use the display portal server command to display the key for the portal server on the access device
•
and view the key for the access device on the portal server.
Use the portal server command to modify the key on the access device or modify the key for the
•
access device on the portal server to make sure that the keys are consistent.

Incorrect server port number on the access device

Symptom
After a user passes the portal authentication, you cannot force the user to log off by executing the portal
delete-user command on the access device, but the user can log off by using the disconnect attribute on
the authentication client.
Analysis
When you execute the portal delete-user command on the access device to force the user to log off, the
access device actively sends a REQ_LOGOUT message to the portal server. The default listening port of
the portal server is 50100. However, if the listening port configured on the access device is not 50100,
the destination port of the REQ_LOGOUT message is not the actual listening port on the server, and the
portal server cannot receive the REQ_LOGOUT message. As a result, you cannot force the user to log off
the portal server.
When the user uses the disconnect attribute on the client to log off, the portal server actively sends a
REQ_LOGOUT message to the access device. The source port is 50100 and the destination port of the
ACK_LOGOUT message from the access device is the source port of the REQ_LOGOUT message so that
the portal server can receive the ACK_LOGOUT message correctly, no matter whether the listening port
is configured on the access device. The user can log off the portal server.
D:Dynamic
MASK
ffff-ffff-ffff
VLAN ID PRIO STATE
3 0 D
183