Nota: Consulte Informações Importantes sobre Comandos de Depuração antes de usar comandos debug.
debug aaa events enable — Este comando pode ser usado para garantir a transferência bem-sucedida dos atributos RADIUS ao cliente através do controlador. Esta parcela do resultado do debug assegura uma transmissão bem-sucedida dos atributos RADIUS.Está aqui a saída deste comando baseado no exemplo de configuração deste documento:Fri Oct 5 15:47:38 2007: 00:40:96:af:3e:93 Successful trans mission of Authentication Packet (id
131) to 10.77.244.196:1812, proxy state 00: 40:96:af:3e:93-96:af Fri Oct 5 15:47:38 2007:
****Enter processIncomingMessages: response code=11 Fri Oct 5 15:47:38 2007: ****Enter processRadiusResponse: response code=11 Fri Oct 5 15:47:38 2007: 00:40:96:af:3e:93 Access-
Challenge received from RADIUS server 10.77.244.196 for mobile 00:40:96:af:3e:93 receiveId =
3 Fri Oct 5 15:47:38 2007: 00:40:96:af:3e:93 Successful transmission of Authentic ation Packet (id 132) to 10.77.244.196:1812, proxy state 00:40:96:af:3e:93-96:af Fri Oct 5
15:47:38 2007: ****Enter processIncomingMessages: response code=11 Fri Oct 5 15:47:38 2007: ****Enter processRadiusResponse: response code=11 Fri Oct 5 15:47:38 2007: 00:40:96:af:3e:93 Access-Challenge received from RADIUS server 10.77.244.196 for mobile 00:40:96:af:3e:93
receiveId = 3 Fri Oct 5 15:47:38 2007: 00:40:96:af:3e:93 Successful transmission of
Authentic ation Packet (id 133) to 10.77.244.196:1812, proxy state 00:40:96:af:3e:93-96:af Fri Oct 5 15:47:38 2007: ****Enter processIncomingMessages: response code=2 Fri Oct 5 15:47:38 2007: ****Enter processRadiusResponse: response code=2 Fri Oct 5 15:47:38 2007: 00:40:96:af:3e:93 Access-Accept received from RADIUS server 10.77.244.196 for mobile
00:40:96:af:3e:93 receiveId = 3 Fri Oct 5 15:47:38 2007: 00:40:96:af:3e:93 Applying new AAA override for station 00:40:96:af:3e:93 Fri Oct 5 15:47:38 2007: 00:40:96:af:3e:93 Override
values for station 00:40:96 :af:3e:93 source: 4, valid bits: 0x200 qosLevel: -1, dscp: 0xffffffff, dot1pTag: 0xffffffff, sessionTimeout: -1 dataAvgC: -1, rTAvgC: -1, dataBurstC: - 1, rTimeBurstC: -1 vlanIfNa me: vlan20, acl Fri Oct 5 15:47:38 2007: 00:40:96:af:3e:93 Inserting new RADIUS override into chain for station 00:40:96:af:3e:93 Fri Oct 5 15:47:38 2007: 00:40:96:af:3e:93 Override values for station 00:40:96 :af:3e:93 source: 4, valid bits: 0x200 qosLevel: -1, dscp: 0xffffffff, dot1pTag: 0xffffffff, sessionTimeout: -1
dataAvgC: -1, rTAvgC: -1, dataBurstC: -1, rTimeBurstC: -1 vlanIfNa me: 'sales', acl Fri Oct 5 15:47:38 2007: 00:40:96:af:3e:93 Applying override policy from source Override Summation: Fri Oct 5 15:47:38 2007: 00:40:96:af:3e:93 Override values for station 00:40:96 :af:3e:93 source: 256, valid bits: 0x200 qosLevel: -1, dscp: 0xffffffff, dot1pTag: 0xffffffff, sessionTimeout: -1 dataAvgC: -1, rTAvgC: -1, dataBurstC: -1, rTimeBurstC: -1 vlanIfNa me: 'sales', a Fri Oct 5 15:47:39 2007: 00:40:96:af:3e:93 Sending Accounting request (0) for
station 00:40:96:af:3e:93 Como visto deste resultado do debug, do WLC passado nos
pedidos de autenticação e das respostas entre o cliente Wireless e o servidor Radius
10.77.244.196. O server autenticou com sucesso o cliente Wireless (este pode ser verificado usando a mensagem da aceitação de acesso). Em cima da autenticação bem sucedida, você pode igualmente ver o servidor Radius transmitir a interface de VLAN name:vlan20,
consequentemente dinamicamente atribuindo o cliente Wireless no VLAN20.
debugar o dot1x aaa permitem — Este comando é usado debugar a autenticação inteira do dot1x que ocorre entre o cliente Wireless e o Authentication Server (ACS).
●
debugar o aaa que todos permitem — Configures debuga de todos os mensagens AAA.Está aqui a saída deste comando baseado no exemplo de configuração deste documento:(Cisco Controller) >Fri Oct 5 16:17:18 2007: AuthenticationRequest: 0xac4be5c
Fri Oct 5 16:17:18 2007: Callback...0x8 29a960
Fri Oct 5 16:17:18 2007: protocolType...0x0 0040001
Fri Oct 5 16:17:18 2007: proxyState...00: 40:96:AF:3E:93-07:00
Fri Oct 5 16:17:18 2007: Packet contains 12 AVPs (not shown)
Fri Oct 5 16:17:18 2007: 00:40:96:af:3e:93 Successful transmission of Authentication Packet
(id 137) to 10.77.244.196:1812, proxy state 00:40:96:af:3e:93-96:af
... ...
... Fri Oct 5 16:17:18 2007: ****Enter processIncomingMessages: response code=11 Fri Oct 5 16:17:18 2007: ****Enter processRadiusResponse: response code=11 Fri Oct 5 16:17:18 2007: 00:40:96:af:3e:93 Access-Challenge received from RADIUS server 10.77.244.196 for mobile 00:40:96:af:3e:93 receiveId = 7 Fri Oct 5 16:17:18 2007: AuthorizationResponse: 0x9845500 Fri Oct 5 16:17:18 2007: structureSize...130 Fri Oct 5 16:17:18 2007:
resultCode...255 Fri Oct 5 16:17:18 2007:
protocolUsed...0x0 0000001 Fri Oct 5 16:17:18 2007:
proxyState...00: 40:96:AF:3E:93-07:00 Fri Oct 5 16:17:18 2007: Packet contains 3 AVPs (not shown)
... ... ...
... Fri Oct 5 16:17:18 2007: ****Enter processIncomingMessages: response code=11 Fri Oct 5 16:17:18 2007: ****Enter processRadiusResponse: response code=11 Fri Oct 5 16:17:18 2007: 00:40:96:af:3e:93 Access-Challenge received from RADIUS server 10.77.244.196 for mobi) Fri Oct 5 16:17:18 2007: 00:40:96:af:3e:93 Successful transmission of Authentication Packet (id 139) to
10.77.244.196:1812, proxy state 00:40:96:af:3e:93-96:af Fri Oct 5 16:17:18 2007: 00000000:
01 8b 00 bb 54 4c 75 3a e5 b9 d2 c0 28 f2 9 3 b3 ....TLu:....(... Fri Oct 5 16:17:18 2007: 00000010: f2 81 50 65 01 10 77 69 72 65 6c 65 73 73 5 c 75 ..Pe..lab\wireless123 Fri Oct 5 16:17:18 2007: 00000020: 73 65 72 31 1f 13 30 30 2d 34 30 2d 39 36 2 d 41 ser1..00-40-96-A Fri Oct 5 16:17:18 2007: 00000030: 46 2d 33 45 2d 39 33 1e 18 30 30 2d 30 42 2 d 38 F-3E- 93..00-0B-8 Fri Oct 5 16:17:18 2007: 00000040: 35 2d 35 42 2d 46 42 2d 44 30 3a 41 44 53 3 1 05 5-5B-FB-D0:wirelessl23. Fri Oct 5 16:17:18 2007: 00000050: 06 00 00 00 01 04 06 0a 4d f4 d4 20 06 57 4 c 43 ...M....WLC Fri Oct 5 16:17:18 2007: 00000060: 31 1a 0c 00 00 37 63 01 06 00 00 00 02 06 0 6 00 1....7c... Fri Oct 5 16:17:18 2007: 00000070: 00 00 02 0c 06 00 00 05 14 3d 06 00 00 00 1 3 4f ...=...O Fri Oct 5 16:17:18 2007: 00000080: 20 01 05 00 1e 11 01 00 08 85 8e 81 b0 7d b f ee ...}.. Fri Oct 5 16:17:18 2007: 00000090: b1 77 69 72 65 6c 65 73 73 5c 75 73 65 72 3 1 18 .lab\wireless123 ... ... ... Fri Oct 5 16:17:18 2007: 00000050: 31 1a 3b 00 00 00 09 01 35 6c 65 61 70 3a 7 3 65 1.;...5leap:se Fri Oct 5 16:17:18 2007: 00000060: 73 73 69 6f 6e 2d 6b 65 79 3d 84 e7 c5 3c 3 3 bd ssion- key=...<3. Fri Oct 5 16:17:18 2007: 00000070: a8 bf 7a 43 9d 6e bb c8 a8 2c 5d c6 91 d6 f 3 21 ..zC.n...,]....! Fri Oct 5 16:17:18 2007: 00000080: df 1e 0e 28 c1 ef a5 31 a7 cd 62 da 1a 1f 0 0 00 ...(...1..b... Fri Oct 5 16:17:18 2007: 00000090: 00 09 01 19 61 75 74 68 2d 61 6c 67 6f 2d 7 4 79 ....auth-algo-ty Fri Oct 5 16:17:18 2007: 000000a0: 70 65 3d 65 61 70 2d 6c 65 61 70 19 17 43 4 1 43 pe=eap-leap..CAC .... Fri Oct 5 16:17:18 2007: ****Enter processIncomingMessages: response code=2 Fri Oct 5 16:17:18 2007: ****Enter
processRadiusResponse: response code=2 Fri Oct 5 16:17:18 2007: 00:40:96:af:3e:93 Access-
Accept received from RADIUS server 10.77.244.196 for mobile 00:40:96:af:3e:93 receiveId = 7
Fri Oct 5 16:17:18 2007: AuthorizationResponse: 0x9845500 Fri Oct 5 16:17:18 2007: structureSize...228 Fri Oct 5 16:17:18 2007:
resultCode...0 Fri Oct 5 16:17:18 2007:
protocolUsed...0x0 0000001 Fri Oct 5 16:17:18 2007:
proxyState...00: 40:96:AF:3E:93-07:02 Fri Oct 5 16:17:18 2007: Packet contains 5 AVPs: Fri Oct 5 16:17:18 2007: AVP[01] Airespace / Interface-
Name... ...vlan20 (5 bytes) Fri Oct 5 16:17:18 2007: AVP[02] EAP-
Message... ...DATA (46 bytes) Fri Oct 5 16:17:18 2007: AVP[03] Cisco / LEAP-Session-Key... ...DATA (16 bytes) Fri Oct 5 16:17:18 2007: AVP[04]
Class... ...CACS:0/5943/a4df4d4/1 (21 bytes) Fri Oct 5 16:17:18 2007: AVP[05] Message-Authenticator... ...DATA (16 bytes) Fri Oct 5 16:17:18 2007: 00:40:96:af:3e:93 Applying new AAA override for station 00:40:96:af:3e:93 Fri Oct 5 16:17:18 2007: 00:40:96:af:3e:93 Override values for station 00:40:96 :af:3e:93
source: 4, valid bits: 0x200 qosLevel: -1, dscp: 0xffffffff, dot1pTag: 0xffffffff,
sessionTimeout: -1 dataAvgC: -1, rTAvgC: -1, dataBurstC: -1, rTimeBurstC: -1 vlanIfNa me: 'sales', acl Fri Oct 5 16:17:18 2007: 00:40:96:af:3e:93 Inserting new RADIUS override into chain for station 00:40:96:af:3e:93 Fri Oct 5 16:17:18 2007: 00:40:96:af:3e:93 Override values for station 00:40:96 :af:3e:93 source: 4, valid bits: 0x200 qosLevel: -1, dscp: 0xffffffff, dot1pTag: 0xffffffff, sessionTimeout: -1 dataAvgC: -1, rTAvgC: -1, dataBurstC: - 1, rTimeBurstC: -1 vlanIfNa me: 'sales', acl Fri Oct 5 16:17:18 2007: 00:40:96:af:3e:93 Applying override policy from source Override Summation: Fri Oct 5 16:17:18 2007:
00:40:96:af:3e:93 Override values for station 00:40:96 :af:3e:93 source: 256, valid bits: 0x200 qosLevel: -1, dscp: 0xffffffff, dot1pTag: 0xffffffff, sessionTimeout: -1 dataAvgC: -1, rTAvgC: -1, dataBurstC: -1, rTimeBurstC: -1 vlanIfNa me: 'sales', a Fri Oct 5 16:17:18 2007: 00:40:96:af:3e:93 Sending Accounting request (0) for station 00:40:96:af:3e:93 Fri Oct 5 16:17:18 2007: AccountingMessage Accounting Interim: 0xac4b1f0 Fri Oct 5 16:17:18 2007: Packet contains 20 AVPs: Fri Oct 5 16:17:18 2007: AVP[01] User-
Name... ...lab\wireless123 (14 bytes) Fri Oct 5 16:17:18 2007:
AVP[02] Nas-Port... ...0x00000001 (1) (4 bytes) Fri Oct 5 16:17:18 2007: AVP[03] Nas-Ip-Address... ...0x0a4df4d4 (172881108) (4 bytes) Fri Oct 5 16:17:18 2007: AVP[04] Class...
...CACS:0/5943/a4df4d4/1 (21 bytes) Fri Oct 5 16:17:18 2007: AVP[05] NAS-
Identifier... ...0x574c4331 (1464615729) (4 bytes) Fri Oct 5 16:17:18 2007: AVP[06] Airespace / WLAN-Identifier... ...0x00000002 (2) (4 bytes)
... ... ...