瞭解客戶端上的CWA流程

下載選項

  • PDF     (1.8 MB)
    在多種裝置上使用 Adobe Reader 檢視
  • ePub     (1.6 MB)
    在 iPhone、iPad、Android、Sony Reader 或 Windows Phone 上的各種應用程式中檢視
  • Mobi (Kindle)     (975.2 KB)
    在 Kindle 裝置或多部裝置的 Kindle 應用程式上檢視
已更新: 2023 年 10 月 6 日
文件 ID:221055

無偏見用語

本產品的文件集力求使用無偏見用語。針對本文件集的目的，無偏見係定義為未根據年齡、身心障礙、性別、種族身分、民族身分、性別傾向、社會經濟地位及交織性表示歧視的用語。由於本產品軟體使用者介面中硬式編碼的語言、根據 RFP 文件使用的語言，或引用第三方產品的語言，因此本文件中可能會出現例外狀況。深入瞭解思科如何使用包容性用語。

關於此翻譯

思科已使用電腦和人工技術翻譯本文件，讓全世界的使用者能夠以自己的語言理解支援內容。請注意，即使是最佳機器翻譯，也不如專業譯者翻譯的內容準確。Cisco Systems, Inc. 對這些翻譯的準確度概不負責，並建議一律查看原始英文文件（提供連結）。

    簡介

    本文檔介紹連線至CWA WLAN時終端客戶端所經歷的流程。

    必要條件

    需求

    思科建議您具備以下基本知識：

    • 思科無線LAN控制器(WLC) 9800系列
    • 對中央Web驗證(CWA)及其在身份服務引擎(ISE)上的配置的一般瞭解

    採用元件

    本檔案中的資訊是根據以下軟體和硬體版本：

    • 9800-CL WLC
    • Cisco AP 3802
    • 9800 WLC Cisco IOS® XE v17.3.6
    • 身分辨識服務引擎(ISE) v3.1

    本文中的資訊是根據特定實驗室環境內的裝置所建立。文中使用到的所有裝置皆從已清除（預設）的組態來啟動。如果您的網路運作中，請確保您瞭解任何指令可能造成的影響。

    背景資訊

    CWA是一種SSID驗證型別，可在WLC上設定，其中嘗試連線的終端使用者端會提示輸入其使用者名稱和密碼到向他們顯示的Web輸入網站。簡而言之，連線到WLAN時，終端客戶端的流量為：

    1. 終端客戶端連線到其裝置上顯示的SSID
    2. 終端客戶端被重定向到Web門戶以輸入其憑證
    3. 終端客戶端使用輸入的憑證由ISE進行身份驗證
    4. ISE回覆WLC表明終端客戶端已透過身份驗證。 ISE可以推送一些客戶端在訪問網路時必須遵守的其他屬性（例如特定ACL）
    5. 終端客戶端重新關聯並重新進行身份驗證，最終獲得網路訪問許可權
    附註圖示

    注意：必須注意，兩次進行身份驗證的終端客戶端對終端客戶端是透明的

    客戶端必須經過的基本過程基本上分為兩部分：從客戶端到ISE伺服器的連線，以及經過身份驗證後從客戶端到網路本身的另一個連線。控制器和ISE始終透過RADIUS協定相互通訊。以下是放射性(RA)追蹤和嵌入式封包擷取(EPC)的深入分析。

    CWA流程-放射性(RA)追蹤

    RA跟蹤是為特定客戶端捕獲的一組日誌。它顯示客戶端在連線到WLAN時經歷的整個過程。有關它們是什麼以及如何檢索RA跟蹤的詳細資訊，請訪問瞭解Catalyst 9800無線LAN控制器上的無線調試和日誌收集。

    第一個連線：客戶端到ISE伺服器

    如果客戶端以前未經ISE授權，則WLC不允許連線到網路。

    與WLAN的關聯

    WLC檢測到客戶端要關聯到WLAN「cwa」，CWA連結到策略配置檔案「cwa-policy-profile，並且正在連線到AP「BC-3802」

    [client-orch-sm] [17558]: (note): MAC: 4203.9522.e682 Association received. BSSID dc8c.37d0.83af, WLAN cwa, Slot 1 AP dc8c.37d0.83a0, BC-3802
    [client-orch-sm] [17558]: (debug): MAC: 4203.9522.e682 Received Dot11 association request. Processing started,SSID: cwa, Policy profile: cwa-policy-profile, AP Name: BC-3802, Ap Mac Address: dc8c.37d0.83a0 BSSID MAC0000.0000.0000 wlan ID: 1RSSI: -46, SNR: 40
    [client-orch-state] [17558]: (note): MAC: 4203.9522.e682 Client state transition: S_CO_INIT -> S_CO_ASSOCIATING
    [dot11-validate] [17558]: (info): MAC: 4203.9522.e682 WiFi direct: Dot11 validate P2P IE. P2P IE not present.

    MAC過濾

    測試ISE伺服器連線

    WLC收到來自客戶端的關聯請求後，第一步是執行MAC過濾（也稱為MAB）。MAC過濾是一種安全方法，根據資料庫檢查客戶端的MAC地址，以驗證是否允許它們加入網路。

    [dot11] [17558]: (info): MAC: 4203.9522.e682 DOT11 state transition: S_DOT11_INIT -> S_DOT11_MAB_PENDING <-- The WLC is waiting for ISE to authenticate the user. It does not send an "Association Response" until the client is accepted by ISE.
    [client-orch-state] [17558]: (note): MAC: 4203.9522.e682 Client state transition: S_CO_ASSOCIATING -> S_CO_MACAUTH_IN_PROGRESS
    [client-auth] [17558]: (note): MAC: 4203.9522.e682 MAB Authentication initiated. Policy VLAN 0, AAA override = 1, NAC = 1 <-- no VLAN is assigned as ISE can do that
    [sanet-shim-translate] [17558]: (ERR): 4203.9522.e682 wlan_profile Not Found : Device information attributes not populated
    [auth-mgr] [17558]: (info): [4203.9522.e682:capwap_90000005] Session Start event called from SANET-SHIM with conn_hdl 14, vlan: 0
    [auth-mgr] [17558]: (info): [4203.9522.e682:capwap_90000005] Wireless session sequence, create context with method MAB
    [auth-mgr-feat_wireless] [17558]: (info): [4203.9522.e682:capwap_90000005] - authc_list: cwa_authz <-- Authentication method list used
    [auth-mgr-feat_wireless] [17558]: (info): [4203.9522.e682:capwap_90000005] - authz_list: Not present under wlan configuration
    [client-auth] [17558]: (info): MAC: 4203.9522.e682 Client auth-interface state transition: S_AUTHIF_INIT -> S_AUTHIF_AWAIT_MAB_AUTH_START_RESP
    [auth-mgr] [17558]: (info): [4203.9522.e682:unknown] auth mgr attr change notification is received for attr (952)
    [auth-mgr] [17558]: (info): [4203.9522.e682:capwap_90000005] auth mgr attr change notification is received for attr (1263)
    [auth-mgr] [17558]: (info): [4203.9522.e682:capwap_90000005] auth mgr attr change notification is received for attr (220)
    [auth-mgr] [17558]: (info): [4203.9522.e682:capwap_90000005] auth mgr attr change notification is received for attr (952)
    [auth-mgr] [17558]: (info): [4203.9522.e682:capwap_90000005] Retrieved Client IIF ID 0x530002f1
    [auth-mgr] [17558]: (info): [4203.9522.e682:capwap_90000005] Allocated audit session id 0E1E140A0000000C8E2DA642
    [auth-mgr] [17558]: (info): [4203.9522.e682:capwap_90000005] Applying policy for WlanId: 1, bssid : dc8c.37d0.83af, slotid: 1 bssid hdl : 12364632849490379189
    [auth-mgr] [17558]: (info): [4203.9522.e682:capwap_90000005] Wlan vlan-id from bssid hdl 0
    [auth-mgr] [17558]: (info): [4203.9522.e682:capwap_90000005] SM Reauth Plugin: Received valid timeout = 1800
    [mab] [17558]: (info): [4203.9522.e682:capwap_90000005] MAB authentication started for 4203.9522.e682
    [client-auth] [17558]: (info): MAC: 4203.9522.e682 Client auth-interface state transition: S_AUTHIF_AWAIT_MAB_AUTH_START_RESP -> S_AUTHIF_MAB_AUTH_PENDING
    [ewlc-infra-evq] [17558]: (note): Authentication Success. Resolved Policy bitmap:11 for client 4203.9522.e682 
    [client-auth] [17558]: (info): MAC: 4203.9522.e682 Client auth-interface state transition: S_AUTHIF_MAB_AUTH_PENDING -> S_AUTHIF_MAB_AUTH_PENDING
    [mab] [17558]: (info): [4203.9522.e682:capwap_90000005] Received event 'MAB_CONTINUE' on handle 0x8A000002 <-- ISE server connectivity has been tested, the WLC is about to send the MAC address to ISE
    [caaa-author] [17558]: (info): [CAAA:AUTHOR:92000002] DEBUG: mlist=cwa_authz for type=1

    WLC向ISE傳送請求

    WLC向ISE傳送RADIUS Access-Request資料包，其中包含要向WLAN進行身份驗證的客戶端的MAC地址。

    [radius] [17558]: (info): RADIUS: Send Access-Request to <ise-ip-addr>:1812 id 0/28, len 415 <-- The packet is traveling via RADIUS port 1812. The "28" is the session ID and it is unique for every connection attempt
    [radius] [17558]: (info): RADIUS: authenticator e7 85 1b 08 31 58 ee 91 - 17 46 82 79 7d 3b c4 30
    [radius] [17558]: (info): RADIUS: User-Name            [1]     14 "42039522e682" <-- MAC address that is attempting to authenticate
    [radius] [17558]: (info): RADIUS: User-Password        [2]     18 *
    [radius] [17558]: (info): RADIUS: Cisco AVpair         [1]     25 "service-type=Call Check" <-- This indicates a MAC filtering process
    [radius] [17558]: (info): RADIUS: Framed-MTU           [12]    6  1485 
    [radius] [17558]: (info): RADIUS: Message-Authenticator[80]    18 ...
    [radius] [17558]: (info): RADIUS: EAP-Key-Name         [102]   2  *
    [radius] [17558]: (info): RADIUS: Cisco AVpair         [1]     43 "audit-session-id=0E1E140A0000000C8E2DA642"
    [radius] [17558]: (info): RADIUS: Cisco AVpair         [1]     12 "method=mab" <-- Controller sends an AVpair with MAB method
    [radius] [17558]: (info): RADIUS: Cisco AVpair         [1]     26 "client-iif-id=1392509681"
    [radius] [17558]: (info): RADIUS: Cisco AVpair         [1]     14 "vlan-id=1000"
    [radius] [17558]: (info): RADIUS: NAS-IP-Address       [4]     6  <wmi-ip-addr> <-- WLC WMI IP address
    [radius] [17558]: (info): RADIUS: NAS-Port-Id          [87]    17 "capwap_90000005"
    [radius] [17558]: (info): RADIUS: NAS-Port-Type        [61]    6  802.11 wireless [19]
    [radius] [17558]: (info): RADIUS: Cisco AVpair         [1]     30 "cisco-wlan-ssid=cwa" <-- SSID and WLAN the client is attempting to connect
    [radius] [17558]: (info): RADIUS: Cisco AVpair         [1]     32 "wlan-profile-name=cwa"
    [radius] [17558]: (info): RADIUS: Called-Station-Id    [30]    32 "dc-8c-37-d0-83-a0:cwa"
    [radius] [17558]: (info): RADIUS: Calling-Station-Id   [31]    19 "42-03-95-22-e6-82"
    [radius] [17558]: (info): RADIUS: Airespace-WLAN-ID    [1]     6  1 
    [radius] [17558]: (info): RADIUS: Nas-Identifier       [32]    9  "BC-9800"
    [radius] [17558]: (info): RADIUS: Started 5 sec timeout
    附註圖示

    注意：AV對是ISE使用的「屬性值」。它是可傳送到WLC的預定義資訊的鍵-值結構。這些值會套用至該特定階段作業的特定使用者端。

    AV-Pairs示例：

    • ACL名稱
    • 重定向URL
    • VLAN分配
    • 會話超時時間
    • 重新驗證計時器

    ISE響應WLC請求

    如果ISE接受WLC傳送的MAC地址，則ISE傳送Access-Accept RADIUS資料包。根據ISE配置，如果它是未知MAC地址，ISE必須接受它並繼續流程。如果顯示Access-Reject，則表示在ISE上存在需要驗證的未正確配置。

    [radius] [17558]: (info): RADIUS: Received from id 1812/28 <ise-ip-addr>:0, Access-Accept, len 334 <-- The packet is traveling via RADIUS port 1812 and is has a session ID of 28 (as a response to the above packet)
    [radius] [17558]: (info): RADIUS: authenticator 14 0a 6c f7 01 b2 77 6a - 3d ba f0 ed 92 54 9b d6
    [radius] [17558]: (info): RADIUS: User-Name            [1]    19  "42-03-95-22-E6-82" <-- MAC address of the client that was authorized by ISE
    [radius] [17558]: (info): RADIUS: Class                [25]   51  ...
    [radius] [17558]: (info): RADIUS: Message-Authenticator[80]   18  ...
    [radius] [17558]: (info): RADIUS: Cisco AVpair         [1]    31  "url-redirect-acl=cwa-acl" <-- ACL to be applied to the client
    [radius] [17558]: (info): RADIUS: Cisco AVpair         [1]    183 "url-redirect=https://<ise-ip-addr>:8443/portal/[...]" <-- Redirection URL for the client
    [radius] [17558]: (info): Valid Response Packet, Free the identifier
    [eap-auth] [17558]: (info): SUCCESS for EAP method name: Identity on handle 0xB0000039
    [mab] [17558]: (info): [4203.9522.e682:capwap_90000005] MAB received an Access-Accept for 0x8A000002
    [mab] [17558]: (info): [4203.9522.e682:capwap_90000005] Received event 'MAB_RESULT' on handle 0x8A000002
    [auth-mgr] [17558]: (info): [4203.9522.e682:capwap_90000005] Authc success from MAB, Auth event success

    從ISE接收資訊的WLC進程

    WLC處理從ISE收到的所有資訊。藉助它，它將應用最初使用ISE傳送的資料建立的使用者配置檔案。例如，WLC會為使用者指派新的ACL。如果未在WLAN上啟用AAA Override，則不會發生WLC的此處理。

     {wncd_x_R0-0}{1}: [aaa-attr-inf] [17558]: (info): 
    << username 0 "42-03-95-22-E6-82">> <-- Processing username received from ISE
     {wncd_x_R0-0}{1}: [aaa-attr-inf] [17558]: (info): 
    << class 0 43 41 43 53 3a 30 45 31 45 31 34 30 41 30 30 30 30 30 30 30 43 38 45 32 44 41 36 34 32 3a 62 63 2d 69 73 65 2f 34 33 36 37 33 31 34 32 37 2f 33 38 >>
     {wncd_x_R0-0}{1}: [aaa-attr-inf] [17558]: (info): 
    <<Message-Authenticator 0 <hidden>>>
     {wncd_x_R0-0}{1}: [aaa-attr-inf] [17558]: (info): 
    << url-redirect-acl 0 "cwa-acl">> <-- Processing ACL redirection received from ISE
     {wncd_x_R0-0}{1}: [aaa-attr-inf] [17558]: (info): 
    << url-redirect 0 "https://<ise-ip-addr>:8443/portal/[...]">> <-- Processing URL redirection received from ISE
     {wncd_x_R0-0}{1}: [aaa-attr-inf] [17558]: (info): 
    << dnis 0 "DC-8C-37-D0-83-A0">>
     {wncd_x_R0-0}{1}: [aaa-attr-inf] [17558]: (info): 
    << formatted-clid 0 "42-03-95-22-E6-82">>
     {wncd_x_R0-0}{1}: [aaa-attr-inf] [17558]: (info): 
    << audit-session-id 0 "0E1E140A0000000C8E2DA642">>
     {wncd_x_R0-0}{1}: [aaa-attr-inf] [17558]: (info): 
    << method 0 2 [mab]>>
     {wncd_x_R0-0}{1}: [aaa-attr-inf] [17558]: (info): 
    << clid-mac-addr 0 42 03 95 22 e6 82 >>
     {wncd_x_R0-0}{1}: [aaa-attr-inf] [17558]: (info): 
    << intf-id 0 2415919109 (0x90000005)>>
    {wncd_x_R0-0}{1}: [auth-mgr] [17558]: (info): [4203.9522.e682:capwap_90000005] auth mgr attr change notification is received for attr (450)
    {wncd_x_R0-0}{1}: [auth-mgr] [17558]: (info): [4203.9522.e682:capwap_90000005] Received User-Name 42-03-95-22-E6-82 for client 4203.9522.e682 
    {wncd_x_R0-0}{1}: [auth-mgr] [17558]: (info): [4203.9522.e682:capwap_90000005] User profile is to be applied. Authz mlist is not present, Authc mlist cwa_authz ,session push flag is unset
    {wncd_x_R0-0}{1}: [webauth-dev] [17558]: (info): Central Webauth URL Redirect, Received a request to create a CWA session for a mac [42:03:95:22:e6:82]
    {wncd_x_R0-0}{1}: [auth-mgr-feat_wireless] [17558]: (info): [0000.0000.0000:unknown] Retrieved zone id 0x0 for bssid 12364632849490379189
    {wncd_x_R0-0}{1}: [webauth-dev] [17558]: (info): No parameter map is associated with mac 4203.9522.e682
    {wncd_x_R0-0}{1}: [epm-redirect] [17558]: (info): [0000.0000.0000:unknown] URL-Redirect-ACL = cwa-acl
    {wncd_x_R0-0}{1}: [epm-redirect] [17558]: (info): [0000.0000.0000:unknown] URL-Redirect = https://<ise-ip-addr>:8443/portal/[...]
    {wncd_x_R0-0}{1}: [auth-mgr] [17558]: (info): [4203.9522.e682:capwap_90000005] User Profile applied successfully for 0x92000002 - REPLACE <-- WLC replaces the user profile it had originally created

    MAB身份驗證完成

    成功修改客戶端的使用者配置檔案後，WLC將完成驗證客戶端的MAC地址。如果從ISE接收的ACL不存在於WLC上，則WLC不知道該如何處理該資訊，因此REPLACE操作完全失敗，導致MAB身份驗證也失敗。使用者端無法進行驗證。

    {wncd_x_R0-0}{1}: [mm-client] [17558]: (debug): MAC: 0000.0000.0000 Sending pmk_update of XID (0) to (MobilityD[0])
    {wncd_x_R0-0}{1}: [client-auth] [17558]: (note): MAC: 4203.9522.e682 MAB Authentication success.
    {wncd_x_R0-0}{1}: [client-auth] [17558]: (info): MAC: 4203.9522.e682 Client auth-interface state transition: S_AUTHIF_MAB_AUTH_PENDING -> S_AUTHIF_MAB_AUTH_DONE
    {wncd_x_R0-0}{1}: [client-orch-sm] [17558]: (debug): MAC: 4203.9522.e682 Processing MAB authentication result status: 0, CO_AUTH_STATUS_SUCCESS

    WLC向客戶端傳送關聯響應

    現在，客戶端已經過ISE身份驗證並且應用了正確的ACL，WLC最終會向客戶端傳送關聯響應。現在，使用者可以繼續連線到網路。

    {wncd_x_R0-0}{1}: [client-orch-state] [17558]: (note): MAC: 4203.9522.e682 Client state transition: S_CO_MACAUTH_IN_PROGRESS -> S_CO_ASSOCIATING
    {wncd_x_R0-0}{1}: [dot11] [17558]: (debug): MAC: 4203.9522.e682 dot11 send association response. Sending association response with resp_status_code: 0 
    {wncd_x_R0-0}{1}: [dot11] [17558]: (debug): MAC: 4203.9522.e682 Dot11 Capability info byte1 1, byte2: 11
    {wncd_x_R0-0}{1}: [dot11-frame] [17558]: (info): MAC: 4203.9522.e682 WiFi direct: skip build Assoc Resp with P2P IE: Wifi direct policy disabled
    {wncd_x_R0-0}{1}: [dot11] [17558]: (info): MAC: 4203.9522.e682 dot11 send association response. Sending assoc response of length: 137 with resp_status_code: 0, DOT11_STATUS: DOT11_STATUS_SUCCESS
    {wncd_x_R0-0}{1}: [dot11] [17558]: (note): MAC: 4203.9522.e682 Association success. AID 1, Roaming = False, WGB = False, 11r = False, 11w = False 
    {wncd_x_R0-0}{1}: [dot11] [17558]: (info): MAC: 4203.9522.e682 DOT11 state transition: S_DOT11_MAB_PENDING -> S_DOT11_ASSOCIATED
    {wncd_x_R0-0}{1}: [client-orch-sm] [17558]: (debug): MAC: 4203.9522.e682 Station Dot11 association is successful.

    L2驗證

    根據客戶端在與WLAN關聯時必須經歷的過程，L2身份驗證「啟動」。但是，實際上已執行L2身份驗證，因為以前執行過MAB身份驗證。客戶端將立即完成L2身份驗證。

    {wncd_x_R0-0}{1}: [client-orch-sm] [17558]: (debug): MAC: 4203.9522.e682 Starting L2 authentication. Bssid in state machine:dc8c.37d0.83af Bssid in request is:dc8c.37d0.83af 
    {wncd_x_R0-0}{1}: [client-orch-state] [17558]: (note): MAC: 4203.9522.e682 Client state transition: S_CO_ASSOCIATING -> S_CO_L2_AUTH_IN_PROGRESS
    {wncd_x_R0-0}{1}: [client-auth] [17558]: (note): MAC: 4203.9522.e682 L2 WEBAUTH Authentication Successful
    {wncd_x_R0-0}{1}: [client-auth] [17558]: (info): MAC: 4203.9522.e682 Client auth-interface state transition: S_AUTHIF_MAB_AUTH_DONE -> S_AUTHIF_L2_WEBAUTH_DONE
    {wncd_x_R0-0}{1}: [client-orch-sm] [17558]: (debug): MAC: 4203.9522.e682 L2 Authentication of station is successful., L3 Authentication : 1

     資料插塞

    WLC將資源指派給連線的使用者端，以便流量可以透過網路傳輸。

    {wncd_x_R0-0}{1}: [client-orch-sm] [17558]: (note): MAC: 4203.9522.e682 Mobility discovery triggered. Client mode: Local
    {wncd_x_R0-0}{1}: [client-orch-state] [17558]: (note): MAC: 4203.9522.e682 Client state transition: S_CO_L2_AUTH_IN_PROGRESS -> S_CO_MOBILITY_DISCOVERY_IN_PROGRESS
    {wncd_x_R0-0}{1}: [mm-transition] [17558]: (info): MAC: 4203.9522.e682 MMIF FSM transition: S_MA_INIT -> S_MA_MOBILITY_DISCOVERY_PROCESSED_TR on E_MA_MOBILITY_DISCOVERY
    {wncd_x_R0-0}{1}: [mm-client] [17558]: (info): MAC: 4203.9522.e682 Invalid transmitter ip in build client context
    {wncd_x_R0-0}{1}: [mm-client] [17558]: (debug): MAC: 4203.9522.e682 Sending mobile_announce of XID (0) to (MobilityD[0])
    {mobilityd_R0-0}{1}: [mm-client] [18482]: (debug): MAC: 4203.9522.e682 Received mobile_announce, sub type: 0 of XID (0) from (WNCD[0])
    {mobilityd_R0-0}{1}: [mm-transition] [18482]: (info): MAC: 4203.9522.e682 MMFSM transition: S_MC_INIT -> S_MC_ANNOUNCE_PROCESSED_NEW_CLIENT_TR on E_MC_ANNOUNCE_RCVD from WNCD[0]
    {mobilityd_R0-0}{1}: [mm-client] [18482]: (debug): MAC: 4203.9522.e682 Add MCC by tdl mac: client_ifid 0xa0000001 is assigned to client
    {mobilityd_R0-0}{1}: [mm-client] [18482]: (debug): MAC: 4203.9522.e682 Sending capwap_msg_unknown (100) of XID (5) to (WNCD[0])
    {mobilityd_R0-0}{1}: [mm-client] [18482]: (debug): MAC: 0000.0000.0000 Sending mobile_announce_nak of XID (5) to (WNCD[0])
    {wncd_x_R0-0}{1}: [mm-client] [17558]: (debug): MAC: 4203.9522.e682 Received mobile_announce_nak, sub type: 1 of XID (5) from (MobilityD[0])
    {wncd_x_R0-0}{1}: [mm-transition] [17558]: (info): MAC: 4203.9522.e682 MMIF FSM transition: S_MA_INIT_WAIT_ANNOUNCE_RSP -> S_MA_NAK_PROCESSED_TR on E_MA_NAK_RCVD
    {wncd_x_R0-0}{1}: [mm-client] [17558]: (info): MAC: 4203.9522.e682 Roam type changed - None -> None
    {wncd_x_R0-0}{1}: [mm-client] [17558]: (info): MAC: 4203.9522.e682 Mobility role changed - Unassoc -> Local
    {wncd_x_R0-0}{1}: [mm-client] [17558]: (note): MAC: 4203.9522.e682 Mobility Successful. Roam Type None, Sub Roam Type MM_SUB_ROAM_TYPE_NONE, Client IFID: 0xa0000001, Client Role: Local PoA: 0x90000005 PoP: 0x0
    {wncd_x_R0-0}{1}: [client-orch-sm] [17558]: (debug): MAC: 4203.9522.e682 Processing mobility response from MMIF. Client ifid: 0xa0000001, roam type: None, client role: Local
    {wncd_x_R0-0}{1}: [ewlc-qos-client] [17558]: (info): MAC: 4203.9522.e682 Client QoS add mobile cb
    {wncd_x_R0-0}{1}: [ewlc-qos-client] [17558]: (info): MAC: 4203.9522.e682 No QoS PM Name or QoS Level received from SANet for pm_dir:0. Check client is fastlane, otherwise set pm name to none
    {wncd_x_R0-0}{1}: [ewlc-qos-client] [17558]: (info): MAC: 4203.9522.e682 No QoS PM Name or QoS Level received from SANet for pm_dir:1. Check client is fastlane, otherwise set pm name to none
    {wncd_x_R0-0}{1}: [client-auth] [17558]: (note): MAC: 4203.9522.e682 ADD MOBILE sent. Client state flags: 0x72 BSSID: MAC: dc8c.37d0.83af capwap IFID: 0x90000005
    {wncd_x_R0-0}{1}: [client-orch-state] [17558]: (note): MAC: 4203.9522.e682 Client state transition: S_CO_MOBILITY_DISCOVERY_IN_PROGRESS -> S_CO_DPATH_PLUMB_IN_PROGRESS
    {wncd_x_R0-0}{1}: [dot11] [17558]: (note): MAC: 4203.9522.e682 Client datapath entry params - ssid:training_cwa,slot_id:1 bssid ifid: 0x0, radio_ifid: 0x90000003, wlan_ifid: 0xf0400001
    {wncd_x_R0-0}{1}: [ewlc-qos-client] [17558]: (info): MAC: 4203.9522.e682 Client QoS dpath create params
    {wncd_x_R0-0}{1}: [ewlc-qos-client] [17558]: (info): MAC: 4203.9522.e682 No QoS PM Name or QoS Level received from SANet for pm_dir:0. Check client is fastlane, otherwise set pm name to none
    {wncd_x_R0-0}{1}: [ewlc-qos-client] [17558]: (info): MAC: 4203.9522.e682 No QoS PM Name or QoS Level received from SANet for pm_dir:1. Check client is fastlane, otherwise set pm name to none
    {wncd_x_R0-0}{1}: [avc-afc] [17558]: (debug): AVC enabled for client 4203.9522.e682 
    {wncd_x_R0-0}{1}: [dpath_svc] [17558]: (note): MAC: 4203.9522.e682 Client datapath entry created for ifid 0xa0000001

    已為使用者分配IP地址

    終端使用者需要IP地址才能在網路間導航。它會經過DHCP程式。如果使用者以前曾連線過，並且記住其IP地址，則會跳過DHCP進程。如果使用者無法收到IP地址，則終端使用者無法檢視Web門戶。否則，它將執行後續步驟：

    1. DISCOVER資料包作為廣播從連線的客戶端傳送，以查詢任何可用的DHCP伺服器
    2. 如果有可用的DHCP伺服器，DHCP伺服器將以OFFER做出響應。該服務內容包含將分配給連線客戶端的IP地址、租用時間等資訊。從各種DHCP伺服器收到許多OFFER
    3. 客戶端接受來自其中一台伺服器的OFFER，並以REQUEST響應所選的IP地址
    4. 最後，DHCP伺服器向客戶端傳送確認資料包，並分配其新IP地址

    WLC會記錄使用者端收到其IP位址的方法。 

    {wncd_x_R0-0}{1}: [client-orch-state] [17558]: (note): MAC: 4203.9522.e682 Client state transition: S_CO_DPATH_PLUMB_IN_PROGRESS -> S_CO_IP_LEARN_IN_PROGRESS
    {wncd_x_R0-0}{1}: [client-iplearn] [17558]: (info): MAC: 4203.9522.e682 IP-learn state transition: S_IPLEARN_INIT -> S_IPLEARN_IN_PROGRESS
    {wncd_x_R0-0}{1}: [client-auth] [17558]: (info): MAC: 4203.9522.e682 Client auth-interface state transition: S_AUTHIF_L2_WEBAUTH_DONE -> S_AUTHIF_L2_WEBAUTH_DONE
    {wncd_x_R0-0}{1}: [auth-mgr-feat_dsensor] [17558]: (info): [4203.9522.e682:capwap_90000005] Skipping DHCP TLVs for further processing. DHCP based classification isn't enabled
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (info): RX: DHCPv4 from interface capwap_90000005 on vlan 1000 Src MAC: 4203.9522.e682 Dst MAC: ffff.ffff.ffff src_ip: 0.0.0.0, dst_ip: 255.255.255.255, BOOTPREQUEST, SISF_DHCPDISCOVER, giaddr: 0.0.0.0, yiaddr: 0.0.0.0, CMAC: 4203.9522.e682 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (info): TX: DHCPv4 from interface capwap_90000005 on vlan 1000 Src MAC: 4203.9522.e682 Dst MAC: ffff.ffff.ffff src_ip: 0.0.0.0, dst_ip: 255.255.255.255, BOOTPREQUEST, SISF_DHCPDISCOVER, giaddr: 0.0.0.0, yiaddr: 0.0.0.0, CMAC: 4203.9522.e682 
    {wncd_x_R0-0}{1}: [auth-mgr-feat_dsensor] [17558]: (info): [4203.9522.e682:capwap_90000005] Skipping DHCP TLVs for further processing. DHCP based classification isn't enabled
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (info): RX: DHCPv4 from interface capwap_90000005 on vlan 1000 Src MAC: 4203.9522.e682 Dst MAC: ffff.ffff.ffff src_ip: 0.0.0.0, dst_ip: 255.255.255.255, BOOTPREQUEST, SISF_DHCPDISCOVER, giaddr: 0.0.0.0, yiaddr: 0.0.0.0, CMAC: 4203.9522.e682 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (info): TX: DHCPv4 from interface capwap_90000005 on vlan 1000 Src MAC: 4203.9522.e682 Dst MAC: ffff.ffff.ffff src_ip: 0.0.0.0, dst_ip: 255.255.255.255, BOOTPREQUEST, SISF_DHCPDISCOVER, giaddr: 0.0.0.0, yiaddr: 0.0.0.0, CMAC: 4203.9522.e682 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (info): RX: DHCPv4 from interface Tw0/0/0 on vlan 1000 Src MAC: dca6.32d2.e93f Dst MAC: 4203.9522.e682 src_ip: <dhcp-server-ip-addr>, dst_ip: <end-user-ip-addr>, BOOTPREPLY, SISF_DHCPOFFER, giaddr: 0.0.0.0, yiaddr: <end-user-ip-addr>, CMAC: 4203.9522.e682 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (info): TX: DHCPv4 from interface Tw0/0/0 on vlan 1000 Src MAC: dca6.32d2.e93f Dst MAC: 4203.9522.e682 src_ip: <dhcp-server-ip-addr>, dst_ip: <end-user-ip-addr>, BOOTPREPLY, SISF_DHCPOFFER, giaddr: 0.0.0.0, yiaddr: <end-user-ip-addr>, CMAC: 4203.9522.e682 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (info): RX: DHCPv4 from interface Tw0/0/0 on vlan 1000 Src MAC: dca6.32d2.e93f Dst MAC: 4203.9522.e682 src_ip: <dhcp-server-ip-addr>, dst_ip: <end-user-ip-addr>, BOOTPREPLY, SISF_DHCPOFFER, giaddr: 0.0.0.0, yiaddr: <end-user-ip-addr>, CMAC: 4203.9522.e682 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (info): TX: DHCPv4 from interface Tw0/0/0 on vlan 1000 Src MAC: dca6.32d2.e93f Dst MAC: 4203.9522.e682 src_ip: <dhcp-server-ip-addr>, dst_ip: <end-user-ip-addr>, BOOTPREPLY, SISF_DHCPOFFER, giaddr: 0.0.0.0, yiaddr: <end-user-ip-addr>, CMAC: 4203.9522.e682 
    {wncd_x_R0-0}{1}: [auth-mgr-feat_dsensor] [17558]: (info): [4203.9522.e682:capwap_90000005] Skipping DHCP TLVs for further processing. DHCP based classification isn't enabled
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (info): RX: DHCPv4 from interface capwap_90000005 on vlan 1000 Src MAC: 4203.9522.e682 Dst MAC: ffff.ffff.ffff src_ip: 0.0.0.0, dst_ip: 255.255.255.255, BOOTPREQUEST, SISF_DHCPREQUEST, giaddr: 0.0.0.0, yiaddr: 0.0.0.0, CMAC: 4203.9522.e682 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (info): TX: DHCPv4 from interface capwap_90000005 on vlan 1000 Src MAC: 4203.9522.e682 Dst MAC: ffff.ffff.ffff src_ip: 0.0.0.0, dst_ip: 255.255.255.255, BOOTPREQUEST, SISF_DHCPREQUEST, giaddr: 0.0.0.0, yiaddr: 0.0.0.0, CMAC: 4203.9522.e682 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (info): RX: DHCPv4 from interface Tw0/0/0 on vlan 1000 Src MAC: dca6.32d2.e93f Dst MAC: 4203.9522.e682 src_ip: <dhcp-server-ip-addr>, dst_ip: <end-user-ip-addr>, BOOTPREPLY, SISF_DHCPACK, giaddr: 0.0.0.0, yiaddr: <end-user-ip-addr>, CMAC: 4203.9522.e682 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (info): TX: DHCPv4 from interface Tw0/0/0 on vlan 1000 Src MAC: dca6.32d2.e93f Dst MAC: 4203.9522.e682 src_ip: <dhcp-server-ip-addr>, dst_ip: <end-user-ip-addr>, BOOTPREPLY, SISF_DHCPACK, giaddr: 0.0.0.0, yiaddr: <end-user-ip-addr>, CMAC: 4203.9522.e682 
    {wncd_x_R0-0}{1}: [client-iplearn] [17558]: (note): MAC: 4203.9522.e682 Client IP learn successful. Method: DHCP IP: <end-user-ip-addr>
    {wncd_x_R0-0}{1}: [epm] [17558]: (info): [0000.0000.0000:unknown] HDL = 0x0 vlan 1000 fail count 0 dirty_counter 0 is_dirty 0
    {wncd_x_R0-0}{1}: [auth-mgr] [17558]: (info): [4203.9522.e682:capwap_90000005] auth mgr attr change notification is received for attr (8)
    {wncd_x_R0-0}{1}: [client-iplearn] [17558]: (info): MAC: 4203.9522.e682 IP-learn state transition: S_IPLEARN_IN_PROGRESS -> S_IPLEARN_COMPLETE
    {wncd_x_R0-0}{1}: [client-orch-sm] [17558]: (debug): MAC: 4203.9522.e682 Received ip learn response. method: IPLEARN_METHOD_DHCP

    L3身份驗證開始

    現在，終端使用者已收到IP地址，L3身份驗證從檢測到作為所需身份驗證方法的CWA開始。

    {wncd_x_R0-0}{1}: [client-orch-sm] [17558]: (debug): MAC: 4203.9522.e682 Triggered L3 authentication. status = 0x0, Success
    {wncd_x_R0-0}{1}: [client-orch-state] [17558]: (note): MAC: 4203.9522.e682 Client state transition: S_CO_IP_LEARN_IN_PROGRESS -> S_CO_L3_AUTH_IN_PROGRESS
    {wncd_x_R0-0}{1}: [client-auth] [17558]: (note): MAC: 4203.9522.e682 L3 Authentication initiated. CWA

    正常IP地址測試

    為了繼續連線，客戶端必須執行兩個ARP請求：

    1. 驗證其他人沒有其IP地址。如果終端使用者的IP地址有ARP應答，則它是重複的IP地址

    2. 驗證網關的可達性。這是為了確保客戶端可以離開網路。ARP回覆必須來自網關

    {wncd_x_R0-0}{1}: [client-auth] [17558]: (info): MAC: 4203.9522.e682 Client auth-interface state transition: S_AUTHIF_L2_WEBAUTH_DONE -> S_AUTHIF_WEBAUTH_PENDING
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): RX: ARP from interface capwap_90000005 on vlan 1000 Source MAC: 4203.9522.e682 Dest MAC: ffff.ffff.ffff ARP REQUEST, ARP sender MAC: 4203.9522.e682 ARP target MAC: 0000.0000.0000 ARP sender IP: 0.0.0.0, ARP target IP: <end-user-ip-addr>, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): TX: ARP from interface capwap_90000005 on vlan 1000 Source MAC: 4203.9522.e682 Dest MAC: 4203.9522.e682 ARP REQUEST, ARP sender MAC: 4203.9522.e682 ARP target MAC: 0000.0000.0000 ARP sender IP: 0.0.0.0, ARP target IP: <end-user-ip-addr>, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): RX: ARP from interface capwap_90000005 on vlan 1000 Source MAC: 4203.9522.e682 Dest MAC: ffff.ffff.ffff ARP REQUEST, ARP sender MAC: 4203.9522.e682 ARP target MAC: 0000.0000.0000 ARP sender IP: 0.0.0.0, ARP target IP: <end-user-ip-addr>, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): TX: ARP from interface capwap_90000005 on vlan 1000 Source MAC: 4203.9522.e682 Dest MAC: 4203.9522.e682 ARP REQUEST, ARP sender MAC: 4203.9522.e682 ARP target MAC: 0000.0000.0000 ARP sender IP: 0.0.0.0, ARP target IP: <end-user-ip-addr>, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): RX: ARP from interface capwap_90000005 on vlan 1000 Source MAC: 4203.9522.e682 Dest MAC: ffff.ffff.ffff ARP REQUEST, ARP sender MAC: 4203.9522.e682 ARP target MAC: 0000.0000.0000 ARP sender IP: 0.0.0.0, ARP target IP: <end-user-ip-addr>, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): TX: ARP from interface capwap_90000005 on vlan 1000 Source MAC: 4203.9522.e682 Dest MAC: 4203.9522.e682 ARP REQUEST, ARP sender MAC: 4203.9522.e682 ARP target MAC: 0000.0000.0000 ARP sender IP: 0.0.0.0, ARP target IP: <end-user-ip-addr>, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): RX: ARP from interface capwap_90000005 on vlan 1000 Source MAC: 4203.9522.e682 Dest MAC: ffff.ffff.ffff ARP REQUEST, ARP sender MAC: 4203.9522.e682 ARP target MAC: 0000.0000.0000 ARP sender IP: <end-user-ip-addr>, ARP target IP: <end-user-ip-addr>, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): TX: ARP from interface capwap_90000005 on vlan 1000 Source MAC: 4203.9522.e682 Dest MAC: 4203.9522.e682 ARP REQUEST, ARP sender MAC: 4203.9522.e682 ARP target MAC: 0000.0000.0000 ARP sender IP: <end-user-ip-addr>, ARP target IP: <end-user-ip-addr>, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): RX: ARP from interface capwap_90000005 on vlan 1000 Source MAC: 4203.9522.e682 Dest MAC: ffff.ffff.ffff ARP REQUEST, ARP sender MAC: 4203.9522.e682 ARP target MAC: 0000.0000.0000 ARP sender IP: <end-user-ip-addr>, ARP target IP: <end-user-ip-addr>, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): TX: ARP from interface capwap_90000005 on vlan 1000 Source MAC: 4203.9522.e682 Dest MAC: 4203.9522.e682 ARP REQUEST, ARP sender MAC: 4203.9522.e682 ARP target MAC: 0000.0000.0000 ARP sender IP: <end-user-ip-addr>, ARP target IP: <end-user-ip-addr>, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): RX: ARP from interface capwap_90000005 on vlan 1000 Source MAC: 4203.9522.e682 Dest MAC: ffff.ffff.ffff ARP REQUEST, ARP sender MAC: 4203.9522.e682 ARP target MAC: 0000.0000.0000 ARP sender IP: <end-user-ip-addr>, ARP target IP: <end-user-ip-addr>, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): TX: ARP from interface capwap_90000005 on vlan 1000 Source MAC: 4203.9522.e682 Dest MAC: 4203.9522.e682 ARP REQUEST, ARP sender MAC: 4203.9522.e682 ARP target MAC: 0000.0000.0000 ARP sender IP: <end-user-ip-addr>, ARP target IP: <end-user-ip-addr>, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): RX: ARP from interface capwap_90000005 on vlan 1000 Source MAC: 4203.9522.e682 Dest MAC: ffff.ffff.ffff ARP REQUEST, ARP sender MAC: 4203.9522.e682 ARP target MAC: 0000.0000.0000 ARP sender IP: <end-user-ip-addr>, ARP target IP: <default-gateway-ip-addr>, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): TX: ARP from interface capwap_90000005 on vlan 1000 Source MAC: 4203.9522.e682 Dest MAC: ffff.ffff.ffff ARP REQUEST, ARP sender MAC: 4203.9522.e682 ARP target MAC: 0000.0000.0000 ARP sender IP: <end-user-ip-addr>, ARP target IP: <default-gateway-ip-addr>, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): RX: ARP from interface Tw0/0/0 on vlan 1000 Source MAC: 64cc.2284.ae10 Dest MAC: 4203.9522.e682 ARP REPLY, ARP sender MAC: 64cc.2284.ae10 ARP target MAC: 4203.9522.e682 ARP sender IP: <default-gateway-ip-addr>, ARP target IP: <end-user-ip-addr>, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): TX: ARP from interface Tw0/0/0 on vlan 1000 Source MAC: 64cc.2284.ae10 Dest MAC: 4203.9522.e682 ARP REPLY, ARP sender MAC: 64cc.2284.ae10 ARP target MAC: 4203.9522.e682 ARP sender IP: <default-gateway-ip-addr>, ARP target IP: <end-user-ip-addr>, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): RX: ARP from interface capwap_90000005 on vlan 1000 Source MAC: 4203.9522.e682 Dest MAC: ffff.ffff.ffff ARP REQUEST, ARP sender MAC: 4203.9522.e682 ARP target MAC: 0000.0000.0000 ARP sender IP: <end-user-ip-addr>, ARP target IP: <dhcp-server-ip-addr>, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): TX: ARP from interface capwap_90000005 on vlan 1000 Source MAC: 4203.9522.e682 Dest MAC: ffff.ffff.ffff ARP REQUEST, ARP sender MAC: 4203.9522.e682 ARP target MAC: 0000.0000.0000 ARP sender IP: <end-user-ip-addr>, ARP target IP: <dhcp-server-ip-addr>, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): RX: ARP from interface Tw0/0/0 on vlan 1000 Source MAC: dca6.32d2.e93f Dest MAC: 4203.9522.e682 ARP REPLY, ARP sender MAC: dca6.32d2.e93f ARP target MAC: 4203.9522.e682 ARP sender IP: <dhcp-server-ip-addr>, ARP target IP: <end-user-ip-addr>, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): TX: ARP from interface Tw0/0/0 on vlan 1000 Source MAC: dca6.32d2.e93f Dest MAC: 4203.9522.e682 ARP REPLY, ARP sender MAC: dca6.32d2.e93f ARP target MAC: 4203.9522.e682 ARP sender IP: <dhcp-server-ip-addr>, ARP target IP: <end-user-ip-addr>, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): RX: ARP from interface capwap_90000005 on vlan 1000 Source MAC: 4203.9522.e682 Dest MAC: ffff.ffff.ffff ARP REQUEST, ARP sender MAC: 4203.9522.e682 ARP target MAC: 0000.0000.0000 ARP sender IP: <end-user-ip-addr>, ARP target IP: <default-gateway-ip-addr>, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): TX: ARP from interface capwap_90000005 on vlan 1000 Source MAC: 4203.9522.e682 Dest MAC: ffff.ffff.ffff ARP REQUEST, ARP sender MAC: 4203.9522.e682 ARP target MAC: 0000.0000.0000 ARP sender IP: <end-user-ip-addr>, ARP target IP: <default-gateway-ip-addr>, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): RX: ARP from interface Tw0/0/0 on vlan 1000 Source MAC: 64cc.2284.ae10 Dest MAC: 4203.9522.e682 ARP REPLY, ARP sender MAC: 64cc.2284.ae10 ARP target MAC: 4203.9522.e682 ARP sender IP: <default-gateway-ip-addr>, ARP target IP: <end-user-ip-addr>, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): TX: ARP from interface Tw0/0/0 on vlan 1000 Source MAC: 64cc.2284.ae10 Dest MAC: 4203.9522.e682 ARP REPLY, ARP sender MAC: 64cc.2284.ae10 ARP target MAC: 4203.9522.e682 ARP sender IP: <default-gateway-ip-addr>, ARP target IP: <end-user-ip-addr>, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): RX: ARP from interface capwap_90000005 on vlan 1000 Source MAC: 4203.9522.e682 Dest MAC: ffff.ffff.ffff ARP REQUEST, ARP sender MAC: 4203.9522.e682 ARP target MAC: 0000.0000.0000 ARP sender IP: <end-user-ip-addr>, ARP target IP: 10.20.30.17, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): TX: ARP from interface capwap_90000005 on vlan 1000 Source MAC: 4203.9522.e682 Dest MAC: ffff.ffff.ffff ARP REQUEST, ARP sender MAC: 4203.9522.e682 ARP target MAC: 0000.0000.0000 ARP sender IP: <end-user-ip-addr>, ARP target IP: 10.20.30.17, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): RX: ARP from interface Tw0/0/0 on vlan 1000 Source MAC: 000c.290e.1c37 Dest MAC: 4203.9522.e682 ARP REPLY, ARP sender MAC: 000c.290e.1c37 ARP target MAC: 4203.9522.e682 ARP sender IP: 10.20.30.17, ARP target IP: <end-user-ip-addr>, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): TX: ARP from interface Tw0/0/0 on vlan 1000 Source MAC: 000c.290e.1c37 Dest MAC: 4203.9522.e682 ARP REPLY, ARP sender MAC: 000c.290e.1c37 ARP target MAC: 4203.9522.e682 ARP sender IP: 10.20.30.17, ARP target IP: <end-user-ip-addr>, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): RX: ARP from interface Tw0/0/0 on vlan 1000 Source MAC: dca6.32d2.e93f Dest MAC: 4203.9522.e682 ARP REQUEST, ARP sender MAC: dca6.32d2.e93f ARP target MAC: 0000.0000.0000 ARP sender IP: <dhcp-server-ip-addr>, ARP target IP: <end-user-ip-addr>, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): TX: ARP from interface Tw0/0/0 on vlan 1000 Source MAC: dca6.32d2.e93f Dest MAC: 4203.9522.e682 ARP REQUEST, ARP sender MAC: dca6.32d2.e93f ARP target MAC: 0000.0000.0000 ARP sender IP: <dhcp-server-ip-addr>, ARP target IP: <end-user-ip-addr>, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): RX: ARP from interface capwap_90000005 on vlan 1000 Source MAC: 4203.9522.e682 Dest MAC: dca6.32d2.e93f ARP REPLY, ARP sender MAC: 4203.9522.e682 ARP target MAC: dca6.32d2.e93f ARP sender IP: <end-user-ip-addr>, ARP target IP: <dhcp-server-ip-addr>, 
    {wncd_x_R0-0}{1}: [sisf-packet] [17558]: (debug): TX: ARP from interface capwap_90000005 on vlan 1000 Source MAC: 4203.9522.e682 Dest MAC: dca6.32d2.e93f ARP REPLY, ARP sender MAC: 4203.9522.e682 ARP target MAC: dca6.32d2.e93f ARP sender IP: <end-user-ip-addr>, ARP target IP: <dhcp-server-ip-addr>,

    第二個連線：客戶端到網路

    此時，終端使用者已經透過ISE的MAC地址對其進行身份驗證，但尚未獲得完全授權。WLC必須再次參考ISE以授權客戶端連線到網路。此時，入口將呈現給使用者，使用者必須在其中輸入其使用者名稱和密碼。在WLC上，可以看到終端使用者處於「Web Auth Pending」狀態。

    授權變更(CoA)

    以下是WLC組態中「支援CoA」的生效位置。在此之前，一直使用ACL。在終端使用者端看到入口網站後，不再使用ACL，因為它只會將使用者端重新導向入口網站。此時，客戶端輸入其憑證以登入，以啟動CoA進程並重新驗證客戶端。WLC準備要傳送的資料包並將其轉發到ISE

    提示圖示

    提示：CoA使用埠1700。請確保防火牆未阻止它。

    {wncd_x_R0-0}{1}: [caaa-ch] [17558]: (info): [CAAA:COMMAND HANDLER:92000002] Processing CoA request under CH-ctx. <-- ISE requests the client to reauthenticate
    {wncd_x_R0-0}{1}: [caaa-ch] [17558]: (info): [CAAA:COMMAND HANDLER:92000002] Reauthenticate request (0x55de3f898b88)
    {wncd_x_R0-0}{1}: [mab] [17558]: (info): [4203.9522.e682:capwap_90000005] MAB re-authentication started for 2315255810 (4203.9522.e682) <-- ISE requests the WLC to reauthenciate the CoA
    {wncd_x_R0-0}{1}: [aaa-coa] [17558]: (info): radius coa proxy relay coa resp(wncd)
    {wncd_x_R0-0}{1}: [aaa-coa] [17558]: (info): CoA Response Details
    {wncd_x_R0-0}{1}: [aaa-attr-inf] [17558]: (info): << ssg-command-code 0 32 >>
    {wncd_x_R0-0}{1}: [aaa-attr-inf] [17558]: (info): << formatted-clid 0 "4203.9522.e682">>
    {wncd_x_R0-0}{1}: [aaa-attr-inf] [17558]: (info): << error-cause 0 1 [Success]>> <-- The WLC responds with a sucess after processing the packet to be sent to ISE
    [aaa-coa] [17558]: (info): server:10.20.30.14 cfg_saddr:10.20.30.14 udpport:64016 sport:0, tableid:0iden:30 rad_code:43 msg_auth_rcvd:TRUE coa_resp:ACK
    [caaa-ch] [17558]: (info): [CAAA:COMMAND HANDLER] CoA response sent <-- The WLC sends the CoA response to ISE

    ISE的第二次身份驗證

    第二個身份驗證不是從零開始。這是美國二氧化碳的威力。新的規則和/或AV paris可以應用於使用者。在第一個Access-Accept上收到的ACL和重定向URL不再推送到終端使用者。

    WLC向ISE傳送請求

    WLC使用輸入的使用者名稱/密碼組合向ISE傳送新的RADIUSAccess-Requestpacket。這將觸發新的MAB身份驗證，並且由於ISE已經知道客戶端，將應用新的策略集（例如，授予訪問許可權）。

    {wncd_x_R0-0}{1}: [mab] [17558]: (info): [4203.9522.e682:capwap_90000005] Received event 'MAB_REAUTHENTICATE' on handle 0x8A000002
    {wncd_x_R0-0}{1}: [caaa-author] [17558]: (info): [CAAA:AUTHOR:92000002] DEBUG: mlist=cwa_authz for type=1
    {wncd_x_R0-0}{1}: [radius] [17558]: (info): RADIUS: Send Access-Request to <ise-ip-addr>:1812 id 0/29, len 421 <-- The packet is traveling via RADIUS port 1812. The "29" is the session ID and it is unique for every connection attempt
    {wncd_x_R0-0}{1}: [radius] [17558]: (info): RADIUS: authenticator c6 ae ab d5 55 c9 65 e2 - 4d 28 01 75 65 54 df 4d
    {wncd_x_R0-0}{1}: [radius] [17558]: (info): RADIUS: User-Name            [1]     14 "42039522e682" <-- MAC address that is attempting to authenticate
    {wncd_x_R0-0}{1}: [radius] [17558]: (info): RADIUS: User-Password        [2]     18 *
    {wncd_x_R0-0}{1}: [radius] [17558]: (info): RADIUS: Cisco AVpair         [1]     25 "service-type=Call Check" <-- This indicates a MAC filtering process
    {wncd_x_R0-0}{1}: [radius] [17558]: (info): RADIUS: Framed-MTU           [12]    6  1485 
    {wncd_x_R0-0}{1}: [radius] [17558]: (info): RADIUS: Message-Authenticator[80]    18 ...
    {wncd_x_R0-0}{1}: [radius] [17558]: (info): RADIUS: EAP-Key-Name         [102]   2  *
    {wncd_x_R0-0}{1}: [radius] [17558]: (info): RADIUS: Cisco AVpair         [1]    43  "audit-session-id=0E1E140A0000000C8E2DA642"
    {wncd_x_R0-0}{1}: [radius] [17558]: (info): RADIUS: Cisco AVpair         [1]    12  "method=mab" <-- Controller sends an AVpair with MAB method
    {wncd_x_R0-0}{1}: [radius] [17558]: (info): RADIUS: Cisco AVpair         [1]    26  "client-iif-id=1392509681"
    {wncd_x_R0-0}{1}: [radius] [17558]: (info): RADIUS: Cisco AVpair         [1]    14  "vlan-id=200"
    {wncd_x_R0-0}{1}: [radius] [17558]: (info): RADIUS: NAS-IP-Address       [4]    6   <wmi-ip-addr> <-- WLC WMI IP address
    {wncd_x_R0-0}{1}: [radius] [17558]: (info): RADIUS: NAS-Port-Id          [87]   17  "capwap_90000005"
    {wncd_x_R0-0}{1}: [radius] [17558]: (info): RADIUS: NAS-Port-Type        [61]   6   802.11 wireless [19]
    {wncd_x_R0-0}{1}: [radius] [17558]: (info): RADIUS: Cisco AVpair         [1]    30  "cisco-wlan-ssid=cwa" <-- SSID and WLAN the client is attempting to connect
    {wncd_x_R0-0}{1}: [radius] [17558]: (info): RADIUS: Cisco AVpair         [1]    32  "wlan-profile-name=cwa"
    {wncd_x_R0-0}{1}: [radius] [17558]: (info): RADIUS: Called-Station-Id    [30]   32  "dc-8c-37-d0-83-a0:cwa"
    {wncd_x_R0-0}{1}: [radius] [17558]: (info): RADIUS: Calling-Station-Id   [31]   19  "42-03-95-22-e6-82"
    {wncd_x_R0-0}{1}: [radius] [17558]: (info): RADIUS: Airespace-WLAN-ID    [1]    6   1 
    {wncd_x_R0-0}{1}: [radius] [17558]: (info): RADIUS: Nas-Identifier       [32]   9   "BC-9800"
    {wncd_x_R0-0}{1}: [radius] [17558]: (info): RADIUS: Started 5 sec timeout

    ISE響應WLC請求

    ISE執行策略查詢，如果收到的使用者名稱與策略配置檔案匹配，則ISE再次響應WLC，接受與WLAN的客戶端連線。它返回終端使用者的使用者名稱。如果在ISE上配置，額外的規則和/或AV對可應用於使用者，且可以在Access-Accept上看到它們。

    {wncd_x_R0-0}{1}: [radius] [17558]: (info): RADIUS: Received from id 1812/29 <ise-ip-addr>:0, Access-Accept, len 131 <-- The packet is traveling via RADIUS port 1812 and is has a session ID of 29 (as a response to the above packet)
    {wncd_x_R0-0}{1}: [radius] [17558]: (info): RADIUS: authenticator a3 b0 45 d6 e5 1e 38 4a - be 15 fa 6b f4 67 62 8a
    {wncd_x_R0-0}{1}: [radius] [17558]: (info): RADIUS: User-Name            [1]  14 "cwa-username" <-- Username entered by the end client on the portal that was shown 
    {wncd_x_R0-0}{1}: [radius] [17558]: (info): RADIUS: Class                [25] 51 ...
    {wncd_x_R0-0}{1}: [radius] [17558]: (info): RADIUS: Message-Authenticator[80] 18 ...
    {wncd_x_R0-0}{1}: [radius] [17558]: (info): RADIUS: Cisco AVpair [1] 22 "profile-name=Unknown"
    {wncd_x_R0-0}{1}: [radius] [17558]: (info): Valid Response Packet, Free the identifier
    {wncd_x_R0-0}{1}: [eap-auth] [17558]: (info): SUCCESS for EAP method name: Identity on handle 0xEE00003B
    {wncd_x_R0-0}{1}: [mab] [17558]: (info): [4203.9522.e682:capwap_90000005] MAB received an Access-Accept for 0x8A000002
    {wncd_x_R0-0}{1}: [mab] [17558]: (info): [4203.9522.e682:capwap_90000005] Received event 'MAB_RESULT' on handle 0x8A000002
    {wncd_x_R0-0}{1}: [auth-mgr] [17558]: (info): [4203.9522.e682:capwap_90000005] Authc success from MAB, Auth event success

    從ISE接收資訊的WLC進程

    WLC將再次處理ISE接收的資訊。它使用從ISE接收的新值對使用者執行另一REPLACE操作。

    [aaa-attr-inf] [17558]: (info): 
    << username 0 "cwa-username">> <-- Processing username received from ISE
    {wncd_x_R0-0}{1}: [aaa-attr-inf] [17558]: (info): 
    << class 0 43 41 43 53 3a 30 45 31 45 31 34 30 41 30 30 30 30 30 30 30 43 38 45 32 44 41 36 34 32 3a 62 63 2d 69 73 65 2f 34 33 36 37 33 31 34 32 37 2f 34 30 >>
    {wncd_x_R0-0}{1}: [aaa-attr-inf] [17558]: (info): 
    <<Message-Authenticator 0 <hidden>>>
    {wncd_x_R0-0}{1}: [aaa-attr-inf] [17558]: (info): 
    << dnis 0 "DC-8C-37-D0-83-A0">>
    {wncd_x_R0-0}{1}: [aaa-attr-inf] [17558]: (info): 
    << formatted-clid 0 "42-03-95-22-E6-82">>
    {wncd_x_R0-0}{1}: [aaa-attr-inf] [17558]: (info): 
    << audit-session-id 0 "0E1E140A0000000C8E2DA642">>
     {wncd_x_R0-0}{1}: [aaa-attr-inf] [17558]: (info): 
    << method 0 2 [mab]>>
     {wncd_x_R0-0}{1}: [aaa-attr-inf] [17558]: (info): 
    << clid-mac-addr 0 42 03 95 22 e6 82 >>
     {wncd_x_R0-0}{1}: [aaa-attr-inf] [17558]: (info): 
    << intf-id 0 2415919109 (0x90000005)>>
    {wncd_x_R0-0}{1}: [auth-mgr] [17558]: (info): [4203.9522.e682:capwap_90000005] auth mgr attr change notification is received for attr (450)
    {wncd_x_R0-0}{1}: [auth-mgr] [17558]: (info): [4203.9522.e682:capwap_90000005] auth mgr attr change notification is received for attr (450)
    {wncd_x_R0-0}{1}: [auth-mgr] [17558]: (info): [4203.9522.e682:capwap_90000005] Received User-Name cwa-username for client 4203.9522.e682
    {wncd_x_R0-0}{1}: [auth-mgr] [17558]: (info): [4203.9522.e682:capwap_90000005] User profile is to be applied. Authz mlist is not present, Authc mlist cwa_authz ,session push flag is unset
    {wncd_x_R0-0}{1}: [auth-mgr] [17558]: (info): [4203.9522.e682:capwap_90000005] User Profile applied successfully for 0x92000002 - REPLACE <-- WLC replaces the user profile it had originally created

    L3身份驗證完成

    終端使用者現在已使用給定資料進行了身份驗證。L3身份驗證（Web身份驗證）已完成。

    {wncd_x_R0-0}{1}: [client-auth] [17558]: (note): MAC: 4203.9522.e682 L3 Authentication Successful. ACL:[]
    {wncd_x_R0-0}{1}: [client-auth] [17558]: (info): MAC: 4203.9522.e682 Client auth-interface state transition: S_AUTHIF_WEBAUTH_PENDING -> S_AUTHIF_WEBAUTH_DONE
    {wncd_x_R0-0}{1}: [ewlc-qos-client] [17558]: (info): MAC: 4203.9522.e682 Client QoS add mobile cb
    {wncd_x_R0-0}{1}: [ewlc-qos-client] [17558]: (info): MAC: 4203.9522.e682 No QoS PM Name or QoS Level received from SANet for pm_dir:0. Check client is fastlane, otherwise set pm name to none
    {wncd_x_R0-0}{1}: [ewlc-qos-client] [17558]: (info): MAC: 4203.9522.e682 No QoS PM Name or QoS Level received from SANet for pm_dir:1. Check client is fastlane, otherwise set pm name to none
    {wncd_x_R0-0}{1}: [client-auth] [17558]: (note): MAC: 4203.9522.e682 ADD MOBILE sent. Client state flags: 0x78 BSSID: MAC: dc8c.37d0.83af capwap IFID: 0x90000005
    {wncd_x_R0-0}{1}: [errmsg] [17558]: (info): %CLIENT_ORCH_LOG-6-CLIENT_ADDED_TO_RUN_STATE: Username entry (cwa-username) joined with ssid (cwa) for device with MAC: 4203.9522.e682 <-- End user "cwa-username" has joined the WLAN "cwa"
    {wncd_x_R0-0}{1}: [aaa-attr-inf] [17558]: (info): [ Applied attribute :               username 0 "cwa-username" ]
    {wncd_x_R0-0}{1}: [aaa-attr-inf] [17558]: (info): [ Applied attribute :                  class 0 43 41 43 53 3a 30 45 31 45 31 34 30 41 30 30 30 30 30 30 30 43 38 45 32 44 41 36 34 32 3a 62 63 2d 69 73 65 2f 34 33 36 37 33 31 34 32 37 2f 34 30 ]
    {wncd_x_R0-0}{1}: [aaa-attr-inf] [17558]: (info): [ Applied attribute :bsn-vlan-interface-name 0 "MGMT" ]
    {wncd_x_R0-0}{1}: [aaa-attr-inf] [17558]: (info): [ Applied attribute : timeout 0 1800 (0x708) ]
    {wncd_x_R0-0}{1}: [ewlc-qos-client] [17558]: (info): MAC: 4203.9522.e682 Client QoS run state handler

    終端使用者在WLC上達到RUN狀態

    最後，使用者透過身份驗證並與WLAN關聯。

    {wncd_x_R0-0}{1}: [rog-proxy-capwap] [17558]: (debug): Managed client RUN state notification: 4203.9522.e682 
    {wncd_x_R0-0}{1}: [client-orch-state] [17558]: (note): MAC: 4203.9522.e682 Client state transition: S_CO_L3_AUTH_IN_PROGRESS -> S_CO_RUN

    CWA流程-嵌入式封包擷取(EPC)

    EPC是可直接從WLC檢索的資料包捕獲，其中顯示透過WLC或源自該WLC的所有資料包。有關它們是什麼以及如何檢索它們的詳細資訊，請訪問瞭解Catalyst 9800無線LAN控制器上的無線調試和日誌收集。

    第一個連線：客戶端到ISE伺服器

    警告圖示

    警告：資料包捕獲映像上的IP地址已刪除。它們顯示為和

    與WLAN的關聯和傳送到ISE伺服器的請求

      第一個資料包第一個資料包

    從WLC到客戶端的關聯請求

    檢視第一個資料包「關聯請求」，您可以看到此過程中涉及的裝置的MAC地址。

    關聯請求關聯請求

    從WLC傳送到ISE的訪問請求資料包

    WLC處理完關聯請求後，WLC會向ISE伺服器傳送Access-Request資料包。

    訪問請求資料包分析訪問請求資料包分析

    1. 封包的名稱。
    2. 嘗試進行身份驗證的MAC地址。
    3. 這表示MAC過濾。
    4. 控制器向ISE傳送的AV對，用於指示MAC過濾過程。
    5. WLC的WMI IP地址。
    6. 客戶端嘗試連線的SSID。
    7. 使用者端嘗試連線的WLAN名稱。

    從WLC傳送到ISE的Access-Accept資料包

    當ISE處理了Access-Accept資料包後，如果成功，它會以Access-Accept做出響應；否則，會以Access-Reject做出響應。

    Access-Accept資料包分析Access-Accept資料包分析

    1. 封包的名稱。
    2. 已驗證的MAC地址。
    3. 要應用的ACL。
    4. 將使用者重新導向到的URL。

    從WLC到客戶端的關聯響應

    關聯回應關聯回應

    DHCP進程

    DHCP進程DHCP進程

    附註圖示

    注意：從現在開始，資料包顯示為重複資料，但這是因為其中有一個是CAPWAP封裝的資料包，而另一個不是

    ARP

    客戶端ARP用於自己的IP地址和網關客戶端ARP用於自己的IP地址和網關

    連線測試

    ARP過程完成後，嘗試連線的裝置會執行檢查以驗證是否觸發了入口，這也稱為探測。如果裝置顯示沒有Internet連線，則表示ARP過程失敗（例如，網關從未應答）或裝置無法執行探測。

    此探測功能在RA跟蹤中是不可見的，只有EPC能夠提供此資訊。探查查詢取決於嘗試連線的裝置，在本示例中，測試裝置是Apple裝置，因此探查直接指向Apple的強制網路門戶。

    當使用URL進行探測時，需要DNS來解決此URL。因此，如果DNS伺服器無法響應客戶端的查詢，則客戶端會繼續查詢該URL，並且門戶從未出現。此時，如果在終端裝置Web瀏覽器上輸入ISE伺服器的IP地址，則必須顯示門戶。如果是，則DNS伺服器發生問題。

    來自客戶端的連線測試- DNS查詢和應答來自客戶端的連線測試- DNS查詢和應答

    DNS解析的IP地址

    在檢查DNS查詢響應時，您可以看到DNS伺服器解析的IP地址。

    DNS伺服器解析的IP地址DNS伺服器解析的IP地址

    建立三次握手

    現在，DNS IP地址已解析，在門戶和客戶端之間建立TCP三次握手。使用的IP地址是解析的任一個IP地址。

    三次握手建立三次握手建立

    取得熱點

    一旦TCP會話建立，客戶端就會執行探測並嘗試訪問門戶。 

    取得熱點取得熱點

    OK資料包

    OK資料包包含客戶端必須重定向到的ISE門戶。  

    OK資料包OK資料包

    附註圖示

    注意：大多數人都在OK資料包中返回了另一個URL。因此，需要執行另一DNS查詢以獲取最終IP地址。

    已建立新的TCP作業階段

    現在已發現門戶的IP地址，因此會交換許多資料包，但最終在OK資料包（或由DNS解析）中返回的目標IP與ISE的IP地址對應的資料包顯示正在建立到門戶的新TCP會話。

    與ISE門戶的第二個連線和新TCP會話與ISE門戶的第二個連線和新TCP會話

    門戶對使用者顯示

    此時，ISE的門戶最終顯示在客戶端瀏覽器的瀏覽器上。與以前一樣，許多資料包在ISE和裝置之間交換；例如客戶端Hello和伺服器Hello等。此處，ISE要求客戶端提供使用者名稱和密碼、接受條款和條件或ISE伺服器上配置的任何內容。 

    CoA請求/CoA確認

    使用者輸入所有請求的資料後，ISE會向控制器傳送CoA請求以更改使用者的授權。如果WLC上的所有內容都已按照預期進行配置（例如具有NAC狀態、支援CoA等），則WLC將傳送CoA確認(CoA ACK)。否則，WLC可能會傳送CoA非確認(CoA NACK)，或乾脆不傳送CoA ACK。

    CoA請求和確認CoA請求和確認

    第二個連線：客戶端到網路

    新建訪問請求

    WLC向ISE傳送新的訪問請求資料包。

    分析新的訪問請求資料包分析新的訪問請求資料包

    1. 封包的名稱。
    2. 嘗試進行身份驗證的MAC地址。
    3. 這表示MAC過濾。
    4. 控制器向ISE傳送的AV對，用於指示MAC過濾過程。
    5. WLC的WMI IP地址。
    6. 客戶端嘗試連線的SSID。
    7. 使用者端嘗試連線的WLAN名稱。

    新存取-接受

    WLC向ISE傳送新的訪問請求資料包。

    新接入接受資料包分析新接入接受資料包分析

    1. 封包的名稱。
    2. 終端客戶端在顯示的門戶上輸入的使用者名稱。

    同樣，從客戶端進行新的探測連線測試。一旦客戶端確認它具有Internet連線，即可關閉門戶（根據使用的裝置可自動關閉）。使用者端現在已連線到網路。

    修訂記錄

    修訂 發佈日期 意見
    1.0
    06-Oct-2023
    初始版本
    TAC Authored

    由思科工程師貢獻

    • Daniela Vignau Leon
      Cisco Technical Consulting Engineer

    這份文件是否有所幫助？

    Feedback意見

    讓思科協助您

    本文件適用於這些產品