Troubleshooting steps for portal authentication error Request timeout to device
- 0 Followed
- 0Collected ，4Browsed
Problem Description
Portal authentication exception, the page displays Request timeout to device or Device did not respond to req_info message
Process Analysis
1. For the issue of portal authentication error due to request to send (RTS) timeout to the device, first check the following main configurations:
1) Check whether the uam.exe and portalserver.exe processes in the monitoring agent deployment are started normally
2) Check the firewall configuration to ensure the interaction ports and IPs during portal authentication are allowed. The required open ports are: UDP 50100, 50200, 50900, 1812, and 1813
3) Verify that the portalserver IP configured on the device matches the server IP of the portal component deployed on the iMC side
4) Check whether the portal NAS IP configured in the portal device interface view matches the IP address entered when adding the portal device on the iMC page
5) Checkwhether the BAS IP configured in the portal device RADIUS scheme view matches the device address configured in the access device management on the iMC page
6) Check whether the key specified when configuring the portal server in the portal device global view matches the key configured on the iMC page
7) Check whether the cryptographic keys configured in the key authentication and key accounting sections of the portal device radius scheme view (these two keys must be identical) match those configured on the iMC page
8) Check whether an IP address group is configured in iMC and correctly referenced under the port group of the portal device, and ensure the referenced IP address group properly includes the terminal IP initiating authentication
9) Determine if there is NAT traversal between the terminal and the iMC server. If NAT traversal exists, select the NAT type when configuring the IP address group and fill in the pre-conversion and post-conversion addresses
10) Are there multiple portal devices on iMC referencing the same IP address group? If so, additional configuration is required on the device to carry bas-ip.
2. After confirming the above configurations are correct, collect information for low level (LL) log analysis to identify the specific cause:
1) BAS device model version, iMC version;
2) BAS device configuration, screenshots of all relevant iMC configurations;
3) Debug portal packet and debug radius packet output from the device (specific debug command needs to be adjusted based on the actual device model);
4) Username used for authentication, terminal IP address, and authentication time point.
5) Reproduction process, UAM debugging logs and portal debugging logs on the iMC server, as well as packet capture on the portal server.
Solution
Scenario 1: Error occurs after entering account password on the authentication page
1. When an error occurs during login after entering the account password, it indicates the authentication has reached the RADIUS stage. Check the portalserver debug logs to see if a REQ_AUTH message was sent to the device. Verify the logs; it was sent normally
2. Next, check the UAM debug logs to confirm whether the RADIUS packet exchange is normal. Check if the device has initiated RADIUS packet No. 1 by searching for Code=1. No results were found. Also, during the corresponding time period, the device did not initiate a RADIUS access-request packet, resulting in abnormal portal interaction:
1) Capture packets on the iMC backend server to acknowledge whether the radius packet from the device is received. If the packet capture shows the radius packet but it is not recorded in the uam log, check whether the radius key is correct and whether the IP of the access device on EIA matches the device IP sending the radius packet in the message. If the configuration is correct, feedback the uam log to 400 for sharing
2) If the radius packet is also not received in the packet capture, check whether the radius scheme configuration is correct. If the configuration is correct, contact the device side for further troubleshooting
3. If the REQ_AUTH message is not found in the portalserver logs, or if the device sends radius packet 1 in the uam debug logs but EIA does not respond, feedback can be provided to iMC 400 for troubleshooting. However, if the uam debug logs show an authentication fail message, refer to the authentication fail reason for further investigation.
Scenario 2: An error occurs on the redirect page, and the login interface fails to pop up.
1. Check the portalserver debug log to see if the REQ_INFO message was sent to the device. If sent, check whether the device replied with an ACK_INFO message in the portalserver debug log. If no reply is received, debug on the device to acknowledge whether the REQ_INFO message sent by iMC was received by the device:
1) If not received or received but replied, troubleshoot the network
2) If received but not replied, confirm the configuration is correct and contact the device for further troubleshooting
2018-05-21 16:11:42.078[portal server][debugging(0)][24][ProxyResponseDeviceHandler::run]172.16.104.2 REQ_INFO(9)
11 ; 172.16.100.14:2000 ; Message processed successfully
<Content>
<Head>
Packet Type<span lang="EN-USCalibri\," sans-serif";="" color:red'="" style="margin: 0px; padding: 0px; word-break: break-all;">:REQ_INFO(9)SerialNo:11 Address:10.1.1.2 Port:50300 RemoteIp:172.16.100.14 RemotePort:2000
Common case summary:
Case 1: https://zhiliao.h3c.com/Theme/details/56075
Case 2: https://zhiliao.h3c.com/Theme/details/171312
Case 3: https://zhiliao.h3c.com/Theme/details/8838
Case 4: https://zhiliao.h3c.com/Theme/details/40817
Case 5: https://zhiliao.h3c.com/Theme/details/173998