https://community.cisco.com/t5/%E6%97%A0%E7%BA%BF%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E5%AE%A2%E6%88%B7%E7%AB%AF%E8%8E%B7%E5%8F%96%E4%B8%8D%E5%88%B0ip%E5%9C%B0%E5%9D%80-ac%E6%8E%A7%E5%88%B6%E5%99%A8%E6%97%A5%E5%BF%97%E6%8A%A5%E9%94%99-authentication-aborted-for-client-aa-bb-cc/m-p/5103261#M16645 <P>怀疑是客户端没有完成L2认证，所以无法获取到IP地址。</P> <P>1.建议在关联不是的客户端上，点击进入某一个客户端，看看客户端无法连接处于的状态。（CLI上可以show client detail &lt;mac-add&gt; 查看；如果是GUI的话，点击您上面的某个客户端的MAC地址就可以了）</P> <P>2.尝试开启debug看看客户端卡在哪个阶段。</P> <UL> <LI>关闭客户端的随机MAC，断开客户端。</LI> <LI>在WLC上开启debug client &lt;mac-add&gt;</LI> <LI>然后让客户端关联该WLAN，等待客户端无法协商后，关闭debug，命令debug disable-all</LI> </UL> <P>3.show radius summ和ping ise的IP地址也可以看看是否正常。看是否和认证服务器之间信息交互。</P> <P>提供一下相关的文件可以看看是什么原因。</P> Mon, 13 May 2024 02:26:11 GMT Rps-Cheers 2024-05-13T02:26:11Z https://community.cisco.com/t5/%E6%97%A0%E7%BA%BF%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E5%AE%A2%E6%88%B7%E7%AB%AF%E8%8E%B7%E5%8F%96%E4%B8%8D%E5%88%B0ip%E5%9C%B0%E5%9D%80-ac%E6%8E%A7%E5%88%B6%E5%99%A8%E6%97%A5%E5%BF%97%E6%8A%A5%E9%94%99-authentication-aborted-for-client-aa-bb-cc/m-p/5103248#M16643 <P>AC是WLC2504。日志报错内容如下：</P><P>*Dot1x_NW_MsgTask_4: May 13 09:59:07.914: #DOT1X-3-ABORT_AUTH: 1x_bauth_sm.c:449 Authentication Aborted for client aa:b4:c9:af:51:c4<BR />*Dot1x_NW_MsgTask_1: May 13 09:59:03.388: #DOT1X-3-ABORT_AUTH: 1x_bauth_sm.c:449 Authentication Aborted for client e2:57:93:1a:af:81<BR />*Dot1x_NW_MsgTask_4: May 13 09:59:02.900: #DOT1X-3-ABORT_AUTH: 1x_bauth_sm.c:449 Authentication Aborted for client aa:b4:c9:af:51:c4<BR />*Dot1x_NW_MsgTask_3: May 13 09:59:02.283: #DOT1X-3-ABORT_AUTH: 1x_bauth_sm.c:449 Authentication Aborted for client 18:65:90:df:4a:6b</P><P>基本上都是这种报错，客户端获取不到地址，控制器看到客户端的地址全部为0.0.0.0，如下图</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="934334822_0-1715565854096.png" style="width: 400px;"><img src="https://community.cisco.com/t5/image/serverpage/image-id/218173i4E95AE162B36FB01/image-size/medium?v=v2&amp;px=400" role="button" title="934334822_0-1715565854096.png" alt="934334822_0-1715565854096.png" /></span></P><P>电脑连接无线，报错无法加入到此网络。如下图：</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="934334822_1-1715565964817.png" style="width: 400px;"><img src="https://community.cisco.com/t5/image/serverpage/image-id/218174i4920D9F069434327/image-size/medium?v=v2&amp;px=400" role="button" title="934334822_1-1715565964817.png" alt="934334822_1-1715565964817.png" /></span></P><P>手机连接无线，弹出证书信任框，点击信任后仍旧连不上，如下图：</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="934334822_3-1715566018303.jpeg" style="width: 400px;"><img src="https://community.cisco.com/t5/image/serverpage/image-id/218176i3346CDC0C6C878A1/image-size/medium?v=v2&amp;px=400" role="button" title="934334822_3-1715566018303.jpeg" alt="934334822_3-1715566018303.jpeg" /></span></P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="934334822_2-1715566011627.jpeg" style="width: 400px;"><img src="https://community.cisco.com/t5/image/serverpage/image-id/218175i9F004564ACE6C14E/image-size/medium?v=v2&amp;px=400" role="button" title="934334822_2-1715566011627.jpeg" alt="934334822_2-1715566011627.jpeg" /></span></P><P>请大佬看看什么情况，找了半天资料，也没有找到解决方法</P><P>&nbsp;</P> Mon, 13 May 2024 02:07:55 GMT https://community.cisco.com/t5/%E6%97%A0%E7%BA%BF%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E5%AE%A2%E6%88%B7%E7%AB%AF%E8%8E%B7%E5%8F%96%E4%B8%8D%E5%88%B0ip%E5%9C%B0%E5%9D%80-ac%E6%8E%A7%E5%88%B6%E5%99%A8%E6%97%A5%E5%BF%97%E6%8A%A5%E9%94%99-authentication-aborted-for-client-aa-bb-cc/m-p/5103248#M16643 934334822 2024-05-13T02:07:55Z https://community.cisco.com/t5/%E6%97%A0%E7%BA%BF%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E5%AE%A2%E6%88%B7%E7%AB%AF%E8%8E%B7%E5%8F%96%E4%B8%8D%E5%88%B0ip%E5%9C%B0%E5%9D%80-ac%E6%8E%A7%E5%88%B6%E5%99%A8%E6%97%A5%E5%BF%97%E6%8A%A5%E9%94%99-authentication-aborted-for-client-aa-bb-cc/m-p/5103260#M16644 <P>补充一下日志界面：</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="934334822_1-1715567008433.png" style="width: 400px;"><img src="https://community.cisco.com/t5/image/serverpage/image-id/218181i52E08162EBC8A957/image-size/medium?v=v2&amp;px=400" role="button" title="934334822_1-1715567008433.png" alt="934334822_1-1715567008433.png" /></span></P><P>AC上看到的客户端的情况：</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="934334822_2-1715567066383.png" style="width: 400px;"><img src="https://community.cisco.com/t5/image/serverpage/image-id/218182iA0E2D371CB2EBC6C/image-size/medium?v=v2&amp;px=400" role="button" title="934334822_2-1715567066383.png" alt="934334822_2-1715567066383.png" /></span></P><P>&nbsp;</P> Mon, 13 May 2024 02:24:41 GMT https://community.cisco.com/t5/%E6%97%A0%E7%BA%BF%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E5%AE%A2%E6%88%B7%E7%AB%AF%E8%8E%B7%E5%8F%96%E4%B8%8D%E5%88%B0ip%E5%9C%B0%E5%9D%80-ac%E6%8E%A7%E5%88%B6%E5%99%A8%E6%97%A5%E5%BF%97%E6%8A%A5%E9%94%99-authentication-aborted-for-client-aa-bb-cc/m-p/5103260#M16644 934334822 2024-05-13T02:24:41Z https://community.cisco.com/t5/%E6%97%A0%E7%BA%BF%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E5%AE%A2%E6%88%B7%E7%AB%AF%E8%8E%B7%E5%8F%96%E4%B8%8D%E5%88%B0ip%E5%9C%B0%E5%9D%80-ac%E6%8E%A7%E5%88%B6%E5%99%A8%E6%97%A5%E5%BF%97%E6%8A%A5%E9%94%99-authentication-aborted-for-client-aa-bb-cc/m-p/5103261#M16645 <P>怀疑是客户端没有完成L2认证，所以无法获取到IP地址。</P> <P>1.建议在关联不是的客户端上，点击进入某一个客户端，看看客户端无法连接处于的状态。（CLI上可以show client detail &lt;mac-add&gt; 查看；如果是GUI的话，点击您上面的某个客户端的MAC地址就可以了）</P> <P>2.尝试开启debug看看客户端卡在哪个阶段。</P> <UL> <LI>关闭客户端的随机MAC，断开客户端。</LI> <LI>在WLC上开启debug client &lt;mac-add&gt;</LI> <LI>然后让客户端关联该WLAN，等待客户端无法协商后，关闭debug，命令debug disable-all</LI> </UL> <P>3.show radius summ和ping ise的IP地址也可以看看是否正常。看是否和认证服务器之间信息交互。</P> <P>提供一下相关的文件可以看看是什么原因。</P> Mon, 13 May 2024 02:26:11 GMT https://community.cisco.com/t5/%E6%97%A0%E7%BA%BF%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E5%AE%A2%E6%88%B7%E7%AB%AF%E8%8E%B7%E5%8F%96%E4%B8%8D%E5%88%B0ip%E5%9C%B0%E5%9D%80-ac%E6%8E%A7%E5%88%B6%E5%99%A8%E6%97%A5%E5%BF%97%E6%8A%A5%E9%94%99-authentication-aborted-for-client-aa-bb-cc/m-p/5103261#M16645 Rps-Cheers 2024-05-13T02:26:11Z https://community.cisco.com/t5/%E6%97%A0%E7%BA%BF%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E5%AE%A2%E6%88%B7%E7%AB%AF%E8%8E%B7%E5%8F%96%E4%B8%8D%E5%88%B0ip%E5%9C%B0%E5%9D%80-ac%E6%8E%A7%E5%88%B6%E5%99%A8%E6%97%A5%E5%BF%97%E6%8A%A5%E9%94%99-authentication-aborted-for-client-aa-bb-cc/m-p/5103266#M16646 <P>初步看就是客户端的L2认证802.1X没有通过。按前面我提到的内容可以先看看。</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Snipaste_2024-05-13_10-27-12.png" style="width: 583px;"><img src="https://community.cisco.com/t5/image/serverpage/image-id/218183i9095431D146D7853/image-size/large?v=v2&amp;px=999" role="button" title="Snipaste_2024-05-13_10-27-12.png" alt="Snipaste_2024-05-13_10-27-12.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Snipaste_2024-05-13_10-27-46.png" style="width: 599px;"><img src="https://community.cisco.com/t5/image/serverpage/image-id/218184i66FB711A3440C542/image-size/large?v=v2&amp;px=999" role="button" title="Snipaste_2024-05-13_10-27-46.png" alt="Snipaste_2024-05-13_10-27-46.png" /></span></P> Mon, 13 May 2024 02:28:40 GMT https://community.cisco.com/t5/%E6%97%A0%E7%BA%BF%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E5%AE%A2%E6%88%B7%E7%AB%AF%E8%8E%B7%E5%8F%96%E4%B8%8D%E5%88%B0ip%E5%9C%B0%E5%9D%80-ac%E6%8E%A7%E5%88%B6%E5%99%A8%E6%97%A5%E5%BF%97%E6%8A%A5%E9%94%99-authentication-aborted-for-client-aa-bb-cc/m-p/5103266#M16646 Rps-Cheers 2024-05-13T02:28:40Z https://community.cisco.com/t5/%E6%97%A0%E7%BA%BF%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E5%AE%A2%E6%88%B7%E7%AB%AF%E8%8E%B7%E5%8F%96%E4%B8%8D%E5%88%B0ip%E5%9C%B0%E5%9D%80-ac%E6%8E%A7%E5%88%B6%E5%99%A8%E6%97%A5%E5%BF%97%E6%8A%A5%E9%94%99-authentication-aborted-for-client-aa-bb-cc/m-p/5103269#M16647 <P>大佬看下，AC跟radius之间的通信是没问题的</P> Mon, 13 May 2024 02:42:03 GMT https://community.cisco.com/t5/%E6%97%A0%E7%BA%BF%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E5%AE%A2%E6%88%B7%E7%AB%AF%E8%8E%B7%E5%8F%96%E4%B8%8D%E5%88%B0ip%E5%9C%B0%E5%9D%80-ac%E6%8E%A7%E5%88%B6%E5%99%A8%E6%97%A5%E5%BF%97%E6%8A%A5%E9%94%99-authentication-aborted-for-client-aa-bb-cc/m-p/5103269#M16647 934334822 2024-05-13T02:42:03Z https://community.cisco.com/t5/%E6%97%A0%E7%BA%BF%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E5%AE%A2%E6%88%B7%E7%AB%AF%E8%8E%B7%E5%8F%96%E4%B8%8D%E5%88%B0ip%E5%9C%B0%E5%9D%80-ac%E6%8E%A7%E5%88%B6%E5%99%A8%E6%97%A5%E5%BF%97%E6%8A%A5%E9%94%99-authentication-aborted-for-client-aa-bb-cc/m-p/5103273#M16648 <PRE class="bp-text bp-text-plain hljs bp-is-scrollable" tabindex="0"><CODE class="bp-text-code txt">apfPemAddUser2:session timeout forstation f0:c3:71:c6:0f:2c - Session Tout 0, apfMsTimeOut '0' and sessionTimerRunning flag is </CODE></PRE> <P>这种报错，在PSK认证的配置下，可能是客户端上 WPA/WPA2 PSK 身份验证的密码配置错误。但是你的是802.1X认证，可以再看看</P> <P>show wlan x (x 表示WLAN id)</P> Mon, 13 May 2024 02:59:35 GMT https://community.cisco.com/t5/%E6%97%A0%E7%BA%BF%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E5%AE%A2%E6%88%B7%E7%AB%AF%E8%8E%B7%E5%8F%96%E4%B8%8D%E5%88%B0ip%E5%9C%B0%E5%9D%80-ac%E6%8E%A7%E5%88%B6%E5%99%A8%E6%97%A5%E5%BF%97%E6%8A%A5%E9%94%99-authentication-aborted-for-client-aa-bb-cc/m-p/5103273#M16648 Rps-Cheers 2024-05-13T02:59:35Z https://community.cisco.com/t5/%E6%97%A0%E7%BA%BF%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E5%AE%A2%E6%88%B7%E7%AB%AF%E8%8E%B7%E5%8F%96%E4%B8%8D%E5%88%B0ip%E5%9C%B0%E5%9D%80-ac%E6%8E%A7%E5%88%B6%E5%99%A8%E6%97%A5%E5%BF%97%E6%8A%A5%E9%94%99-authentication-aborted-for-client-aa-bb-cc/m-p/5103281#M16649 <P>目前取消radius认证了，无线暂时无需认证，可以使用了，情况没办法复现了。问题可能出来radius服务器上。感谢大佬</P> Mon, 13 May 2024 03:08:08 GMT https://community.cisco.com/t5/%E6%97%A0%E7%BA%BF%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E5%AE%A2%E6%88%B7%E7%AB%AF%E8%8E%B7%E5%8F%96%E4%B8%8D%E5%88%B0ip%E5%9C%B0%E5%9D%80-ac%E6%8E%A7%E5%88%B6%E5%99%A8%E6%97%A5%E5%BF%97%E6%8A%A5%E9%94%99-authentication-aborted-for-client-aa-bb-cc/m-p/5103281#M16649 934334822 2024-05-13T03:08:08Z https://community.cisco.com/t5/%E6%97%A0%E7%BA%BF%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E5%AE%A2%E6%88%B7%E7%AB%AF%E8%8E%B7%E5%8F%96%E4%B8%8D%E5%88%B0ip%E5%9C%B0%E5%9D%80-ac%E6%8E%A7%E5%88%B6%E5%99%A8%E6%97%A5%E5%BF%97%E6%8A%A5%E9%94%99-authentication-aborted-for-client-aa-bb-cc/m-p/5103282#M16650 <PRE class="bp-text bp-text-plain hljs bp-is-scrollable" tabindex="0"><CODE class="bp-text-code txt">*Dot1x_NW_MsgTask_4: May 13 10:37:36.046: f0:c3:71:c6:0f:2c<FONT color="#FF0000"> Processing AAA Error 'Timeout' (-5) for mobile f0:c3:71:c6:0f:2c</FONT> *Dot1x_NW_MsgTask_4: May 13 10:37:36.046: f0:c3:71:c6:0f:2c Sent Deauthenticate to mobile on BSSID c4:b9:cd:22:69:b0 slot 1(caller 1x_auth_pae.c:1581)</CODE></PRE> <P><SPAN>Return AAA Error Timeout (-5) for Mobile，感觉可能还是和ISE有关系，通常这种情况表示AAA Server Unreachable的可能。不知道WLC和ISE之间是否还有其他中间设备，端口是否放开？</SPAN></P> <P>可以参考Verify Radius Server Connectivity with Test AAA Radius Command看看是否能做一些测试。</P> <P><A href="https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/212473-verify-radius-server-connectivity-with-t.html" target="_blank">https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/212473-verify-radius-server-connectivity-with-t.html</A></P> Mon, 13 May 2024 03:12:01 GMT https://community.cisco.com/t5/%E6%97%A0%E7%BA%BF%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E5%AE%A2%E6%88%B7%E7%AB%AF%E8%8E%B7%E5%8F%96%E4%B8%8D%E5%88%B0ip%E5%9C%B0%E5%9D%80-ac%E6%8E%A7%E5%88%B6%E5%99%A8%E6%97%A5%E5%BF%97%E6%8A%A5%E9%94%99-authentication-aborted-for-client-aa-bb-cc/m-p/5103282#M16650 Rps-Cheers 2024-05-13T03:12:01Z https://community.cisco.com/t5/%E6%97%A0%E7%BA%BF%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E5%AE%A2%E6%88%B7%E7%AB%AF%E8%8E%B7%E5%8F%96%E4%B8%8D%E5%88%B0ip%E5%9C%B0%E5%9D%80-ac%E6%8E%A7%E5%88%B6%E5%99%A8%E6%97%A5%E5%BF%97%E6%8A%A5%E9%94%99-authentication-aborted-for-client-aa-bb-cc/m-p/5103283#M16651 <P>可以，那后续需要恢复802.1X认证之后，你可以再检查看看。</P> Mon, 13 May 2024 03:14:06 GMT https://community.cisco.com/t5/%E6%97%A0%E7%BA%BF%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E5%AE%A2%E6%88%B7%E7%AB%AF%E8%8E%B7%E5%8F%96%E4%B8%8D%E5%88%B0ip%E5%9C%B0%E5%9D%80-ac%E6%8E%A7%E5%88%B6%E5%99%A8%E6%97%A5%E5%BF%97%E6%8A%A5%E9%94%99-authentication-aborted-for-client-aa-bb-cc/m-p/5103283#M16651 Rps-Cheers 2024-05-13T03:14:06Z