users are logged out of IMC

[hawada]

Hello,

We are facing a problem with connected users using 8021.x auth, while users are logged in to their appropriate VLAN and working; suddenly some users go disconnected and this happened randomly while sometimes the whole users got disconnected from the IMC and I see the following error  "E63117: system unknown error" and to fix this problem we restarted the IMC server.

IMC version 7.2 (E0403) and UAM 7.2 (E0403)

Appreciate your support.

Thank you in advance,

[ibias]

Firstly please update your system to imc V7.3E0506P03 and also the UAM module (iMC UAM v7.3 (E0505P02)).

If the problem furthermore exist, please contact the customer support of HPE.

[NeilR]

You can probably just update to iMC_PLAT_7.2_E0403P10_Win & iMC_UAM_7.2_E0411 - the last versions of 7.2 if you don't want to go to 7.3

Those worked perfectly fine for my 802.1x setup and HP probably can still be able to help you.

You do not mention what port settings you've used. Those settings may be part of the issue.

[hawada]

Thank you ibais for your update.

Thank you NeilR, I prefer to update the IMC to IMC_PLAT_7.2_E0403P10_Win & iMC_UAM_7.2_E0411 instead of upgrading it to v 7.3 to avoid losing LAN Access Service we discussed in previous discussions :

https://community.hpe.com/t5/IMC/Missing-quot-LAN-Access-Service-quot/m-p/6988827#M4179

the ports I am using on IMC and switches are Radius UDP port 1812 and Radius Accounting UDP port 1813.

Thank you.

[NeilR]

Yes - i found moving to 7.3 was a bit challenging. Once you get uam stable then you can migrate.

Those ports are for the radius session. Imc server is your radius server. make sure the switch can always talk to it.

I meant the switch interface settings. I'm using procurve and there are settings for re-authentication period and other parameters. You should review the switch documentation. These parameters are not set by imc but need to be deployed using the deploy commands option for all the ports used.

I would suggest setting up a lab switch to test with. The cli view should have an option to display authentication status, so you can see the changes as a user connects and disconnects. Also you can use a constant ping to the user device to see when the port is active during the process and monitor whether it stays active.