Network Topology
On-site traffic mirroring will be performed on the core switch-AC and core switch-authentication server interfaces for internet behavior management.
Problem Description
Mirror traffic displays the username correctly in internet behavior management: employee ID + name.
Partially abnormal: domain suffix prevents displaying correct employee ID and name.
Process Analysis
1. Verify that the AC service template configuration is normal, and no differences are found when comparing the IPs of abnormal accounts.
2. It was discovered that normal and abnormal accounts belong to different groups. By capturing packets on the AC mirror and comparing abnormal and normal packets, differences were observed in the information carried by the terminal requests themselves.
Normal situation:
abnormal situation:
Later, it was acknowledged that terminals may occasionally use computer identity verify. Adjust the terminal network card settings -- select user identity verify.
3. Subsequent testing revealed that the anomaly occurs when on-site computers are domain-joined, while non-domain terminals display normally; using the computer's built-in settings for 1X authentication, the server side cannot view the authentication account
Collect AC-related debug analysis: debugging radius all/debugging dot1x all, compare packet differences
Analysis of normal and abnormal accounts shows differences during access-request. AC does not modify terminal accounts. The account in the access-request remains unchanged. This issue requires checking the configuration on the authentication terminal side to see if there is an option to prioritize host-based account login. The ireless device itself does not modify accounts.
Solution
It is recommended to troubleshoot terminal-side configuration for resolution