Alcatel Carrier Internetworking Solutions 8800 User Manual

Troubleshooting AVLAN

Troubleshooting Authenticated VLANs

page 18-4

OmniSwitch Troubleshooting Guide

-> show mac-address-table
Legend: Mac Address: * = address not valid

 Vlan      Mac Address          Type       Protocol    Operation    Interface

------+-------------------+--------------+-----------+------------+-----------

     2   00:c0:4f:0c:3a:e4     learned              0     bridging      1/21
Total number of Valid MAC addresses above = 1

Now verify that the Gateway defined in RADIUS server point towards the right IP address. ARP table 
confirms that the switch has learned the ARP entry of the RADIUS server. Verify that the IP address of 
the RADIUS server has been learned in the correct VLAN and the port it has been attached.

-> show arp

Total 1 arp entries

Flags (P=Proxy, A=Authentication, V=VRRP)

IP Addr           Hardware Addr       Type       Flags   Port     Interface

-----------------+-------------------+----------+-------+--------+-----------
192.168.10.100    00:c0:4f:0c:3a:e4   DYNAMIC    1/21  vlan 2

4 Verify that the Authentication shared secret on the radius server and the switch (Radius client) is same. 

There is no show command to check the Authentication shared secret on the switch for the security 
purpose. The only way to verify is reenter the shared secret using the aaa radius-server CLI command 

5 If so far so good and radius server is rejecting user request, verify the user configuration on the radius 
server to make sure he/she is using correct user name and password. Read the the “Managing Authentica-
tion Servers” chapter in the appropriate OmniSwitch Network Configuration Guide for detail information 
about Radius server attributes and configuration. Check log file on the radius server for more information.

If client can’t communicate to the remote station in the Authenticated VLAN using multiple protocols 
simultaneously then check below possible configuration mistakes.

Let’s take an example of user who is trying to communicate to the target machine using both IP and IPX. 
The communication might failure because of one or more of the following steps.

1 If client can’t communicate using IP and IPX, troubleshoot the basic authentication issues using the 
procedures described in 

 and 

 

explained earlier in this chapter.

2 If authentication works fine using IP not IPX then troubleshoot the Radius Server as explained in next 
steps.

3 Locate Alcatel.dct file under Radius installed folder on the Radius Server. Open this file using Note-
pad and look for the ATTRIBUTE “Alcatel-Auth-Group-Protocol”. If you don’t see this attribute then 
contact Alcatel Customer Support to get the latest Alcatel.dct (Alcatel Dictionary) file. Replace it with the 
new one.

4 Once the new file is in place make sure you associate multiple protocol with the Authenticated VLAN 
that user moving into. Refer to the “Managing Authentication Servers” chapter in the appropriate 
OmniSwitch Network Configuration Guide for Vendor-Specific Attributes for RADIUS.