Troubleshooting guide

3. Troubleshooting Functional Failures During Operation
114
For AX3800S, AX3600S, or AX2400S series switches, if communication is not possible on a port
or VLAN that uses IEEE 802.1X, isolate the cause of the problem according to the failure analysis
method described in the table below. If neither is the case, see 3.6 Layer 2 network communication
7 Execute the show dot1x logging
command, and check whether dynamic
allocation in VLAN-based
authentication (dynamic) failed.
• If
Failed to assign VLAN.(Reason: No Tunnel-Type
Attribute) is displayed, dynamic allocation has failed because the
Tunnel-Type attribute is not set for the RADIUS attribute of the
RADIUS frame. Add the Tunnel-Type attribute in the RADIUS
attribute setting of the RADIUS server.
• If
Failed to assign VLAN.(Reason:Tunnel-Type Attribute
is not VLAN(13) ) is displayed, dynamic allocation has failed
because the value of the
Tunnel-Type attribute for the RADIUS
attribute is not VLAN(13). Set VLAN(13) for the Tunnel-Type
attribute of the RADIUS server.
• If
Failed to assign VLAN.(Reason: No Tunnel-Medium-Type
Attribute) is displayed, dynamic allocation has failed because the
Tunnel-Medium-Type attribute is not set for the RADIUS attribute.
Set the Tunnel-Medium-Type attribute for the RADIUS attribute of
the RADIUS server.
• If
Failed to assign VLAN. (Reason: Tunnel-Medium-Type
Attribute is not IEEE802(6) ) is displayed, dynamic allocation
has failed. This is because the value of the
Tunnel-Medium-Type
attribute is not IEEE802(6) or because the value of the
Tunnel-Medium-Type attribute is correct but the tag value does not
match the tag of the
Tunnel-Type attribute. Set the correct value or
tag for the Tunnel-Medium-Type attribute for the RADIUS attribute
of the RADIUS server.
• If
Failed to assign VLAN. (Reason: No
Tunnel-Private-Group-ID Attribute) is displayed, dynamic
allocation has failed because the
Tunnel-Private-Group-ID
attribute is not set for the RADIUS attribute of the RADIUS server.
Set the
Tunnel-Private-Group-ID attribute for the RADIUS
attribute of the RADIUS server.
• If
Failed to assign VLAN. (Reason: Invalid
Tunnel-Private-Group-ID Attribute) is displayed, dynamic
allocation has failed because an invalid value is set for the
Tunnel-Private-Group-ID attribute for the RADIUS attribute. Set
the correct VLAN ID for the
Tunnel-Private-Group-ID attribute
for the RADIUS attribute of the RADIUS server.
• If
Failed to assign VLAN. (Reason: The VLAN ID is out of
range.) is displayed, dynamic allocation has failed. This is because
a VLAN ID that is out of range is set for the
Tunnel-Private-Group-ID attribute for the RADIUS attribute of
the RADIUS server. Set the correct VLAN ID for the
Tunnel-Private-Group-ID attribute.
• If
Failed to assign VLAN. (Reason: The port doesn't
belong to VLAN.) is displayed, dynamic allocation has failed. This
is because the authentication port does not belong to the VLAN ID
specified for the
Tunnel-Private-Group-ID attribute for the
RADIUS attribute of the RADIUS server. Correct the configuration so
that the VLAN ID specified for the
Tunnel-Private-Group-ID
attribute for the RADIUS attribute of the RADIUS server matches the
VLAN ID of the MAC VLAN specified for the authenticating port.
• If
Failed to assign VLAN. (Reason: The VLAN ID is not set
to radius-vlan.) is displayed, the VLAN ID specified for the
Tunnel-Private-Group-ID attribute of the RADIUS attribute of
the RADIUS server is not enabled for VLAN-based authentication
(dynamic). Correct the configuration so that the VLAN ID specified
for the
Tunnel-Private-Group-ID attribute for the RADIUS
attribute of the RADIUS server matches the VLAN ID of the MAC
VLAN specified for the authenticating port.
If none of the above apply, see the RADIUS server log to check whether
authentication has failed.
No. Items to check and commands Action