topic WLC with ACS 5.1 (RADIUS) for Management AND Network users in Network Access Control

WLC with ACS 5.1 (RADIUS) for Management AND Network users

shahedvoicerite — Mon, 11 Mar 2019 00:13:52 GMT

Hi,

I have setup RADIUS authentication for Management AND network users, on my NM-WLC (running 5.2) against ACS 5.1

My Question is :-

For Admin users to login, I need to return "Service-Type=Administrative-User" in order for it to work.

Since the ACS sees all requests coming in from the same device (WLC) for Admin as well as Network users,

the way I am currently handling this is by creating a filter based on user-name

So, users that contain "admin" in their user-id, use one set of

Network Access Authorization Policy, which has an associated Authorization Profile, with RADIUS attributes.

Normal users, have a different "Network Access Authorization Policy Rule", with another Profile.

While this DOES WORK fine, I am still left wondering if there is a better way to do this, rather than create a rule,

based on user-name.

I could use TACACS+ for Management, but I dont think ACS allows the same AAA client (WLC) to use both protocols.

Thanks

Re: WLC with ACS 5.1 (RADIUS) for Management AND Network users

Richard Atkin — Mon, 05 Jul 2010 15:30:33 GMT

Hi,

You can use RADIUS and TACACS at the same time, without any problems (I have done it my self several times), you can then use different service selection rules based on whether the request came via RADIUS or TACACS. The limitation of only supporting RADIUS OR TACACS on applies to v4.2 and earlier.

Rgds,

Richard

Re: WLC with ACS 5.1 (RADIUS) for Management AND Network users

shahedvoicerite — Mon, 05 Jul 2010 15:36:59 GMT

Thanks. Earlier I was trying to add the same client twice with different protocols.

Just tried checking both checkboxes (radius & tacacs+), for a single aaa client, and it let me do that.

So I guess I *CAN* use TACACS+ for Management and RADIUS for Network users....

But is that the way its normally done ?

What if I only wanted to use RADIUS only ?

Is there a better way to distinguish between Management and network users ??

Thanks

Re: WLC with ACS 5.1 (RADIUS) for Management AND Network users

jrabinow — Tue, 06 Jul 2010 06:29:58 GMT

I think this is a very common way for things to be done

You may notice that out of the box ACS 5 comes preinstalled with a service selection policy that differentiates requests based on the protocol and directs either to a "Default Network Access" or "Default Device Admin" service

If you only want to do RADIUS can either disable or delete the rule for TACACS+ requests or not select TACACS+ in device definitions

topic WLC with ACS 5.1 (RADIUS) for Management *AND* Network users in Network Access Control

WLC with ACS 5.1 (RADIUS) for Management *AND* Network users

Re: WLC with ACS 5.1 (RADIUS) for Management *AND* Network users

Re: WLC with ACS 5.1 (RADIUS) for Management *AND* Network users

Re: WLC with ACS 5.1 (RADIUS) for Management *AND* Network users

topic WLC with ACS 5.1 (RADIUS) for Management AND Network users in Network Access Control

WLC with ACS 5.1 (RADIUS) for Management AND Network users

Re: WLC with ACS 5.1 (RADIUS) for Management AND Network users

Re: WLC with ACS 5.1 (RADIUS) for Management AND Network users

Re: WLC with ACS 5.1 (RADIUS) for Management AND Network users