某局点 WX3024H-L 结合云简做固定账号认证失败

现场结合云简做的固定账号认证，WX3024H-L是本地转发

初始报错

查看配置发现是本地转发，必须要配置portal client-gateway interface vlan x，指定AC上已配置IP地址的某个vlan,让认证服务器获取AC设备接口地址。添加上后还是报错

此时查看display tcp verbose | be portal

<H3C-AC-WX3024-2F-PWR>dis tcp verbose | be portal

Creator: portald[179]

State: ISCONNECTED

 Options: SO_SEQPACKET

 Error: 0

Receiving buffer(cc/hiwat/lowat/drop/state): 0 / 66364 / 1 / 0 / CANTREDUCESIZE

 Sending buffer(cc/hiwat/lowat/state): 0 / 64952 / 512 / N/A

Type: 1

Protocol: 6

Connection info: Src = 10.1.100.253:29939, Dst = 101.36.161.143:443

Inpcb flags: INP_ANONPORT INP_SYNCPCB

 Inpcb extflag: N/A

Inpcb vflag: INP_IPV4

 TTL: 255(minimum TTL: 0)

Connection state: ESTABLISHED

TCP options: TF_NODELAY TF_REQ_SCALE TF_RCVD_SCALE TF_REQ_TSTMP TF_SACK_PERMIT

 NSR state: CLOSED(M)

Send VRF: 0x0

Receive VRF: 0x0

Location:

 NSR standby: N/A

Creator: stamgrd[150]

State: ISCONNECTED

发现目的地址是101.36.161.143

ping oasisauth.h3c.com

发现解析地址为101.36.161.146

添加上静态解析

ip host oasisauth.h3c.com 101.36.161.146

测试还是报错，此时能够弹出认证输入账号密码但是报网络故障

继续查看配置发现本地转发缺少portal host-check enable

加上后正常

本地转发添加portal client-gateway interface vlan x，指定AC上已配置IP地址的某个vlan,让认证服务器获取AC设备接口地址

根据查看tcp连接信息与 ping oasisauth.h3c.com解析出的地址做对比，添加静态解析ip host oasisauth.h3c.com 101.36.161.146

本地转发添加portal host-check enable