Problem Description
AC combined with IMC for remote portal without awareness found that the terminal remains online after clicking offline
View user
Process Analysis
No abnormalities were found in the configuration, nor were any version-related issues detected. Enable debugging portal all and debugging radius all. The process for manually clicking offline on the terminal authentication page is as follows:
*Jan 5 15:08:15:424 2024 H3C_AC01 PORTAL/7/EVENT: User-SM[172.X.X.X]: Received accounting-off response.
*Jan 5 15:08:15:424 2024 H3C_AC01 PORTAL/7/FSM: User-SM[172.X.X.X]: Begin to run.
*Jan 5 15:08:15:424 2024 H3C_AC01 PORTAL/7/FSM: User-SM [172.X.X.X]: State changed from Offline_Waiting_Acctoff to Done.
*Jan 5 15:08:15:424 2024 H3C_AC01 PORTAL/7/EVENT: User-SM[172.X.X.X]: Stopped User-SM timer.
*Jan 5 15:08:15:424 2024 H3C_AC01 PORTAL/7/FSM: User-SM[172.X.X.X]: User was destroyed. //Manually click offline on the terminal authentication page, and the terminal goes offline successfully
Portal sent 46 bytes of packet: Type=ack_logout(6), ErrCode=0, IP=172.X.X.X //Offline success, AC sends terminal offline message to server
*Jan 5 15:08:15:425 2024 H3C_AC01 PORTAL/7/PACKET:
[ 11 SESSIONID ] [ 8] [XXXX-XXXX-XXXX]
At this time, although the terminal is offline, the wifi is not disconnected, and certain actions of the terminal itself trigger the mac-trigger authentication process:
*Jan 5 15:08:15:542 2024 H3C_AC01 PORTAL/7/MAC-trigger: //Trigger mac-trigger process
MAC-trigger rule:
InterfaceL3 = WLAN-BSS1/0/103
InterfaceL2 = WLAN-BSS1/0/103
VLAN = 303
SrcMAC = XXXX-XXXX-XXXX
SrcIP = 172.X.X.X
*Jan 5 15:08:15:542 2024 H3C_AC01 PORTAL/7/MAC-trigger Event: Notify portal daemon new MAC-trigger entry successfully, SrcIP=172.X.X.X, SrcMAC=XXXX-XXXX-XXXX.
*Jan 5 15:08:15:542 2024 H3C_AC01 PORTAL/7/RULE:
[Inbound] execute full rule match, { MatchRes = [Rule2-Deny] }
IfName = WLAN-BSS1/0/103, PortName = WLAN-BSS1/0/103, Vlan = 303, SrcMAC = XXXX-XXXX-XXXX,
SrcIP = 172.X.X.X, DstIP = 40.X.X.X
*Jan 5 15:08:15:543 2024 H3C_AC01 PORTAL/7/MAC-trigger Event: Received MAC overflow event, MAC=XXXX-XXXX-XXXX.
*Jan 5 15:08:15:544 2024 H3C_AC01 PORTAL/7/EVENT: Success to get ssid by user mac, ssid:Client-Portal, user MAC:XX-XX-XX-XX-XX-XX.
*Jan 5 15:08:15:544 2024 H3C_AC01 PORTAL/7/PACKET:
Portal sent 55 bytes of packet: Type=req_macbind_info(48), ErrCode=0, IP=172.X.X.X //AC sends MAC binding query request to server
*Jan 5 15:08:15:545 2024 H3C_AC01 PORTAL/7/MAC-trigger Event: MAC entry(XXXX-XXXX-XXXX) state changed from DEFAULT to WAIT, user IP = 172.X.X.X.
*Jan 5 15:08:15:546 2024 H3C_AC01 PORTAL/7/EVENT: Success to get info from wlan snooping, vlan:303. mac:XXXX-XXXX-XXXX,userip:172.X.X.X
*Jan 5 15:08:15:546 2024 H3C_AC01 PORTAL/7/EVENT: Success to get ifindex(1926) and vlan(303) from IPCIM, user IP=172.X.X.X,MAC=XXXX-XXXX-XXXX
*Jan 5 15:08:15:546 2024 H3C_AC01 PORTAL/7/PACKET:
Portal received 16 bytes of packet: Type=ack_macbind_info(49), ErrCode=0, IP=172.X.X.X // server returns query result ErrCode equals 0 indicates that the MAC is already bound on the server and can proceed with mac-trigger onboarding
*Jan 5 15:08:15:546 2024 H3C_AC01 PORTAL/7/MAC-trigger Event: MAC entry(XXXX-XXXX-XXXX) state changed from WAIT to BIND. user IP=172.X.X.X. // mac-trigger authentication succeeded
Solution
It is normal for the Portal mac-trigger authentication combining on-site AC and IMC to remain online and allow normal internet access after clicking offline because although the portal is offline, the wireless connection is not terminated. Certain terminal behaviors may trigger mac-trigger online again, enabling normal internet access.
Therefore, in the on-site Portal mac-trigger scenario, clicking offline on the terminal cannot prevent internet access. You can force the terminal offline via IMC, which should also clear the mac-trigger entry. The terminal will require authentication to go online again.