NEC IP8800/S3600, IP8800/S6600, IP8800/S2400 manual Layer 2 Authentication Communication Failure

3. Troubleshooting Functional Failures in Operation

3.12 Layer 2 Authentication Communication Failure

3.12.1Communication Failure on Using IEEE 802.1X

If authentication is disabled when using IEEE 802.1X, isolate the problem by following failure analysis methods shown in the table below.

Table 3-48: IEEE 802.1X Failure Analysis Method

No.	Troubleshooting Steps and Command		Action
1	Execute the show dot1x command and	If "Dot1x doesn't seem to be running" is displayed, IEEE802.1X has stopped.
	check the operation status of the	Check to see if the dot1x system-auth-controlcommand is set in the
	IEEE802.1X.	configuration.
		Go to No. 2 if "System 802.1X: Enable" is displayed.
2	Execute the show dot1x statistics	If RxTotal of [EAPOL frames] is 0, the terminal does not send EAPOL. If
	command and confirm that EAPOL is	RxInvalid or RxLenErr is not 0, illegal EAPOL has been received from the
	exchanged.	terminal. When illegal EAPOL is received, log is recorded. The log can be
		browsed using show dotlx logging command. The log shows the "Invalid
		EAPOL frame received" message and the contents of illegal EAPOL. Check the
		Supplicant setting on the terminal.
		Otherwise, go to No. 3.
3	Execute the show dot1x statistics	If "TxTotal" of [EAP overRADIUS frames] is set to 0, it indicates that no data is
	command and confirm that data is sent to the	sent to the RADIUS server. Confirm the following:
	RADIUS server.	•	Check to see if aaa authentication dot1x default group
			radius is set by the configuration command.
		•	Check to see if the configuration command radius-server host is set
			correctly.
		• If the authentication mode is port authentication or VLAN authentication
			(static), confirm that the authentication terminal is not registered by the
			configuration command mac-address-table static. If the
			authentication mode is VLAN authentication (dynamic), confirm that the
			authentication terminal is not registered by the configuration command
			mac-address.
		• If the authentication mode is VLAN authentication (dynamic), check to see if
			aaa authorization network default group radius is set by
			the configuration command.
		Otherwise, go to No. 4.
4	Execute the show dot1x statistics	If "RxTotal" of [EAP overRADIUS frames] is set to 0, packets are not received
	command and confirm that data is received	from the RADIUS server. Confirm the following:
	from the RADIUS server.	• If the RADIUS server is accommodated in the remote network, confirm that the
			route to the remote network exists.
		• Confirm that the port of the RADIUS server is excluded from authentication.
		Otherwise, go to No. 5.
5	Execute the show dot1x logging	• If "Invalid EAP over RADIUS frames received" is output, illegal packets are
	command and check exchange with the		received from the RADIUS server. Check to see if the RADIUS server is
	RADIUS server.		normally operating.
		• If "Failed to connect to RADIUS server" is output, connection to the RADIUS
			server failed. Check to see if the RADIUS server is normally operating.
		Otherwise, go to No. 6.

89