UNSOLVED
Powerconnect 6224/6248 802.1X issues
Hi,
I'm running a stack of 6224/6248 switches in a windows 2008R2 environment. They are configured to control access through 802.1 (auto-mode) and to get the authentication information, including vlan assignment from my primary NPS server (RADIUS). Everything seemed to be running ok at first, but at random times, clients are dropped and are no longer able to access the network. However, when I look at the port status at that time, the port still shows up as 'authenticated'; however no packets can flow. Sometimes it helps to disable and enable the network adapter or to physically disconnect the cable. However, that is not a good solution for 100+ PCs
I've checked the NPS logs, but everything seems fine there; it indicates that users are granted access and put into the right VLAN. Looking at the remote syslog of the switch stack, I get entries like these throughout the day :
8 192.168.100.100-1 TRAPMGR[152722416]: traputil.c(611) 4735 %% Link on 6/0/16 is failed
2012-01-06 09:53:31 Local7.Notice 192.168.100.100 JAN 06 09:53:18 192.168.100.100-1 TRAPMGR[152722416]: traputil.c(611) 4736 %% 6/0/16 is transitioned from the Forwarding state to the Blocking state in instance 0
2012-01-06 09:53:31 Local7.Error 192.168.100.100 JAN 06 09:53:19 192.168.100.100-6 DOT1X[140205616]: dot1x_nsf.c(853) 4737 %% Notification(2) received for entry(4400) not present
2012-01-06 09:53:31 Local7.Error 192.168.100.100 JAN 06 09:53:19 192.168.100.100-6 DOT1X[140205616]: dot1x_nsf.c(853) 4738 %% Notification(2) received for entry(4416) not present
2012-01-06 09:53:31 Local7.Error 192.168.100.100 JAN 06 09:53:19 192.168.100.100-6 DOT1X[140205616]: dot1x_nsf.c(853) 4739 %% Notification(2) received for entry(4432) not present
2012-01-06 09:53:31 Local7.Error 192.168.100.100 JAN 06 09:53:19 192.168.100.100-6 DOT1X[140205616]: dot1x_nsf.c(853) 4740 %% Notification(2) received for entry(4448) not present
2012-01-06 09:53:31 Local7.Error 192.168.100.100 JAN 06 09:53:19 192.168.100.100-6 DOT1X[140205616]: dot1x_nsf.c(853) 4741 %% Notification(2) received for entry(4544) not present
2012-01-06 09:53:31 Local7.Error 192.168.100.100 JAN 06 09:53:19 192.168.100.100-6 DOT1X[140205616]: dot1x_nsf.c(853) 4742 %% Notification(2) received for entry(4560) not present
2012-01-06 09:53:31 Local7.Error 192.168.100.100 JAN 06 09:53:19 192.168.100.100-6 DOT1X[140205616]: dot1x_nsf.c(853) 4743 %% Notification(2) received for entry(4656) not present
2012-01-06 09:53:31 Local7.Error 192.168.100.100 JAN 06 09:53:19 192.168.100.100-6 DOT1X[140205616]: dot1x_nsf.c(853) 4744 %% Notification(2) received for entry(4800) not present
2012-01-06 09:53:31 Local7.Error 192.168.100.100 JAN 06 09:53:19 192.168.100.100-6 DOT1X[140205616]: dot1x_nsf.c(853) 4745 %% Notification(2) received for entry(4816) not present
2012-01-06 09:53:35 Local7.Notice 192.168.100.100 JAN 06 09:53:22 192.168.100.100-1 TRAPMGR[152722416]: traputil.c(611) 4746 %% 6/0/16 status is Unauthorized
2012-01-06 09:53:35 Local7.Notice 192.168.100.100 JAN 06 09:53:22 192.168.100.100-1 TRAPMGR[152722416]: traputil.c(611) 4747 %% Link Up: 6/0/16
At other times, the log is filled with entries like these
0 JAN 06 09:53:44 192.168.100.100-6 DOT1X[140205616]: dot1x_nsf.c(827) 4780 %% Notification(1) received for entry(4432) already present
2012-01-06 09:53:56 Local7.Error 192.168.100.100 JAN 06 09:53:44 192.168.100.100-6 DOT1X[140205616]: dot1x_nsf.c(827) 4781 %% Notification(1) received for entry(4448) already present
2012-01-06 09:53:56 Local7.Error 192.168.100.100 JAN 06 09:53:44 192.168.100.100-6 DOT1X[140205616]: dot1x_nsf.c(827) 4782 %% Notification(1) received for entry(4544) already present
2012-01-06 09:53:56 Local7.Error 192.168.100.100 JAN 06 09:53:44 192.168.100.100-6 DOT1X[140205616]: dot1x_nsf.c(827) 4783 %% Notification(1) received for entry(4560) already present
2012-01-06 09:53:56 Local7.Error 192.168.100.100 JAN 06 09:53:44 192.168.100.100-6 DOT1X[140205616]: dot1x_nsf.c(827) 4784 %% Notification(1) received for entry(4656) already present
2012-01-06 09:53:56 Local7.Error 192.168.100.100 JAN 06 09:53:44 192.168.100.100-6 DOT1X[140205616]: dot1x_nsf.c(827) 4785 %% Notification(1) received for entry(4800) already present
Does anyone have any idea what could be going wrong ? As I said, the state of the port remains 'authenticated' in the switch. I've tried raising the re-authentication period to no avail.
Thanks
Regards,
Peter
sjbradbury
10 Posts
1654
0
Posted January 22nd, 2012 15:00
I have two stacked 6248Ps displaying this problem and exact symptoms the original poster described. I have a 3rd 6248 that's not stacked, but configured identically that does not have any dot1x issues that I've seen. All of them are running software 3.3.1.10.
Could this issue be some bug related to stacking?
sjbradbury
10 Posts
1662
0
Posted March 15th, 2012 16:00
If you split the stack your issues will go away.
What I've discovered working with a Dell tech so far...
Only the Master switch in the stack has these problems, and only on ports 25-48. If you move the master role to a different physical switch, the issue will follow to wherever the master role is and you will start to have issues on ports 25-48. This leads me to believe it's a software bug in the switch.
Dell has been trying to duplicate the issue, but I'm not sure they're having any success. The cheapest/quickest solution to this problem, until Dell is able to identify the bug and fix it, is to split your stack and run individual switches (what a pain). Or, don't use ports 25-48 on the master switch with dot1x authentication, just set those ports to forced-auth or don't use them.
cedric.beaujon
1 Rookie
•
7 Posts
1654
0
Posted March 15th, 2012 16:00
Hi there, I also the very same errors and troubles. I thought that was due to hardware clients. I have noticed that I get troubles to connect clients with a docking bay laptops and also gx620. At the moment I have migrated 2 floors and stay on hold before getting a clear view of the issue. I can try to split the stack and see how it goes as suggested sjbradbury. Anyway I have been told from Dell that those switches 6248 and radius are causing some problems when they are stacked.
Regards,
Cedric
sjbradbury
10 Posts
1662
0
Posted August 6th, 2013 06:00
Version 3.3.5.5 seems to have made this problem much worse. Now the problem occurs on single switches and not only as stacked switches. Very, very disappointing Dell.
If you need 802.1x auth on your wired network, do not use powerconnect.
sjbradbury
10 Posts
1662
0
Posted September 17th, 2013 05:00
I have not, and honestly I probably never will. It's way too disruptive to have user machines and devices randomly dropping off the network.jasondalziel
5 Posts
525
0
Posted February 25th, 2014 02:00
I have had the similar issue detailed in the following post
But I am using unmanaged switches on the ports and it's when plugged into these I see the problem (and also on the newer 7000 series switches). When I originally asked Dell to confirm that this particular post (in the Dell community) wasn't an issue prior to purchasing the switches I was told that it was the port energy saving settings that had caused this particular issue so I had nothing to worry about, I'm starting to wonder if this has always been a problem and subsequent revisions of firmware have not addressed it.
Suffice to say in my environment I will have to either increase my number of floorports or purchase some more managed switches that support 802.1x to put at some of our higher concentration of desks in our office.
I'm looking at this and thinking it's not really as secure as I'd like it to be :(
jasondalziel
5 Posts
525
0
Posted March 12th, 2014 09:00
OK so the latest I have is that it's not part of the current software and it appears to not mention anything like this in the IEEE standard, but the standard also does not mention that it's not supported. So whereas this sort of solution would work fine within a CISCO environment with CISCO switches and VMPS, it will not at present work with Dell switches, so watch out if you are wanting to use 802.1x in this way!
The result is that I have to shell out a whole lot of extra money that I didn't see coming just for moving away from CISCO and to Dell, so is the cost difference really worth moving away?
So, would I be right in summarizing that 802.1x is basically unusable with powerconnect switches ?
I have run into all sorts of trouble with the latest two releases of firmware I have upgraded too... Wish I still had a copy of the version that worked fine for about a year...
sjbradbury
10 Posts
1654
0
Posted January 21st, 2012 12:00
I am having this exact same problem. Did you figure anything out to resolve this?