topic Re: ISE 2.6 and Cat9800 tacacs+ config for Lobby Admin in Network Access Control

ISE 2.6 and Cat9800 tacacs+ config for Lobby Admin

Jan81 — Thu, 18 Jun 2020 12:11:22 GMT

Hello, we are currently in the migration phase to a catalyst 9800 wlc. I am currently working on the tacacs configuration and I making no progress with setting up the lobby admins tacacs profile.

With the old airos wlc you could simply select "Lobby Admin" in the tacacs profile, but with the new IOSXE-based wlc the profile don't work.

A profile for admin access is working fine at privilege level 15. Can anyone help me with that?

Best regards Jan

Re: ISE 2.6 and Cat9800 tacacs+ config for Lobby Admin

poongarg — Thu, 18 Jun 2020 16:42:19 GMT

Check if you are running into below issue:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvs87163

If the lobby admin user is getting full access?

Re: ISE 2.6 and Cat9800 tacacs+ config for Lobby Admin

Jan81 — Fri, 19 Jun 2020 05:44:10 GMT

Thanks, I have checked the aaa config and reconfigure the authorization and authentication settings.

But my problem is to configure the tacacs profile and command sets. For admin access it works fine with priv level 15. But for lobby admin access I don´t know what I must configure. For the old airos wlc it was easy to choose the right value, but his won´t work for catalyst 9800 wlc.

If I add a local lobby admin account on the wlc, I see that the user has the following settings.

user-name lobby
 view LobbyAdminView
 type lobby-admin

But when I configure this as custom attributes in the tacacs profiles it won´t work.

Re: ISE 2.6 and Cat9800 tacacs+ config for Lobby Admin

poongarg — Fri, 19 Jun 2020 06:15:12 GMT

Set the TACACS to return the following:

Default Privilege: priv-lvl=15

Custom attributes: Type= Mandatory, Name=user-type, Value= lobby-admin

On WLC, configure the username:

aaa remote username <remote-lobby-admin-username>

Re: ISE 2.6 and Cat9800 tacacs+ config for Lobby Admin

Jan81 — Fri, 19 Jun 2020 08:09:21 GMT

Thanks, that works, but I point the authorization policy in the ise config to an active directory group. Must I configure for each user in the group the "aaa remote username"?

Re: ISE 2.6 and Cat9800 tacacs+ config for Lobby Admin

poongarg — Fri, 19 Jun 2020 08:36:16 GMT

The username created on AD or ISE local DB for the Lobby Ambassador has to be defined as a remote username on the WLC. If the remote username is not defined in the WLC, the authentication will go through correctly, however, the user will be granted with full access to the WLC instead of only access to the Lobby Ambassador privileges.

Re: ISE 2.6 and Cat9800 tacacs+ config for Lobby Admin

Jan81 — Fri, 19 Jun 2020 08:39:30 GMT

Okay, thanks for your help! Greetings Jan

Re: ISE 2.6 and Cat9800 tacacs+ config for Lobby Admin

Nieo — Thu, 27 Nov 2025 11:08:10 GMT

Hi,

This solution works well, thank you.

However, I have observed that users are getting full CLI access to the WLC, whereas the GUI access functions as expected. Do you have any suggestions on how to restrict or manage CLI access with LobbyAdmin User?