topic Re: limit admin access to specific AP group in Network Access Control

limit admin access to specific AP group

phuoc.nt — Mon, 25 Jan 2021 05:38:30 GMT

Dear everyone,

My system has WLC, ISE, PI. My operator IT want to manage themselves all the APs that are installed inside their building.

On the WLC, we have AP group based on location but I don't know how to limit admin access to a specific AP group.

Could you please share your experience on this issue?

Thank you so much!

Re: limit admin access to specific AP group

Mohammed al Baqari — Mon, 25 Jan 2021 06:23:20 GMT

Hi,

The list of roles in WLC doesn't allow to limit access to single group of
APs. You cannot create custom roles like in other products such as CUCM for
example.

**** please remember to rate useful posts

Re: limit admin access to specific AP group

Panos Bouras — Mon, 25 Jan 2021 16:01:54 GMT

HI @phuoc.nt

As @Mohammed al Baqari mentioned ISE controls access to WLC in the form of the vertical menus at WLC, so there's no way to limit access to specific AP group or any other sub-menu.

Check this guide also (Device Administration of Cisco WLC using TACACS+)

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-24/215125-device-administration-of-cisco-wlc-using.html

Re: limit admin access to specific AP group

thomas — Mon, 25 Jan 2021 21:35:44 GMT

I assume you are talking about Device Administration with TACACS and not RADIUS for network access.

See https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-24/215125-device-administration-of-cisco-wlc-using.html where it shows you can only control access to the individual tabs in the WLC. The WLC does not have options for finer control than the tabs in the web GUI.

Re: limit admin access to specific AP group

phuoc.nt — Wed, 27 Jan 2021 07:44:10 GMT

Thank you everyone for the clear explanation.