topic Re: WEBconsole Radius Authentication in Network Access Control

WEBconsole Radius Authentication

kristiqirjako99 — Mon, 12 Feb 2024 14:48:35 GMT

Hello,

I am having a problem with radius authentication on the web console. The connect with radius is OK, i can see the request which is accepted from the radius side, where i do prv-lvl=15, but at the webpage it just reloads and rerequires again the authentication, so I am not able to login.

It looks like something is missing in the reply from RADIUS.

Re: WEBconsole Radius Authentication

balaji.bandi — Mon, 12 Feb 2024 15:04:35 GMT

Try different browser.

Re: WEBconsole Radius Authentication

MHM Cisco World — Mon, 12 Feb 2024 15:06:02 GMT

It is GUI of WLC wat you want to auth via radius?

MHM

Re: WEBconsole Radius Authentication

kristiqirjako99 — Mon, 12 Feb 2024 15:06:25 GMT

The problem persists. If I turn off the radius authentification, and I keep it locally authenticated, all works fine

Re: WEBconsole Radius Authentication

kristiqirjako99 — Mon, 12 Feb 2024 15:07:25 GMT

GUI

Re: WEBconsole Radius Authentication

balaji.bandi — Mon, 12 Feb 2024 15:08:37 GMT

Cheers that browser is ok, what Radius ?

Re: WEBconsole Radius Authentication

kristiqirjako99 — Mon, 12 Feb 2024 15:10:25 GMT

ClearPass

Re: WEBconsole Radius Authentication

MHM Cisco World — Mon, 12 Feb 2024 15:10:56 GMT

Sorry dont get your answer' it GUI of WLC ?

MHM

Re: WEBconsole Radius Authentication

kristiqirjako99 — Mon, 12 Feb 2024 15:12:47 GMT

Sorry, it is the GUI of a cisco switch

Re: WEBconsole Radius Authentication

MHM Cisco World — Mon, 12 Feb 2024 15:14:54 GMT

Ok' can I see how you config the SW.

MHM

Re: WEBconsole Radius Authentication

kristiqirjako99 — Mon, 12 Feb 2024 15:17:13 GMT

These are the configurations regarding the HTTP Radius

aaa group server radius ADMIN-RAD-SERVERS
server name cppma
server name cppmb
deadtime 15
!
!/ Authorization list Radius local /!
aaa authentication login default group ADMIN-RAD-SERVERS local
aaa authorization console
aaa authorization config-commands
aaa authorization exec default group ADMIN-RAD-SERVERS local

ip http authentication aaa login-authentication default
ip http authentication aaa exec-authorization default
!/ Enable https server /!
ip http secure-server
ip ssh time-out 60
ip ssh authentication-retries 2
ip ssh version 2
ip scp server enable
!

Re: WEBconsole Radius Authentication

MHM Cisco World — Mon, 12 Feb 2024 15:28:21 GMT

ip http authentication aaa

Then re add

ip http authentication aaa login-authentication default
ip http authentication aaa exec-authorization default

MHM

Re: WEBconsole Radius Authentication

kristiqirjako99 — Mon, 12 Feb 2024 15:35:00 GMT

Nope, the problem persists. I can see the request in RADIUS, and also the privilege level is given, but there may be something missing from the Radius reply i think.

Re: WEBconsole Radius Authentication

Aref Alsouqi — Mon, 12 Feb 2024 15:52:35 GMT

I would try to turn off and back on the HTTPS services with the commands "no ip http secure-server" and "ip http secure-server". If that doesn't help, maybe I would try to use a custom method list instead of the default one similar to this:

aaa authentication login RAD-SERVERS group ADMIN-RAD-SERVERS local
aaa authorization exec RAD-SERVERS group ADMIN-RAD-SERVERS local

ip http authentication aaa login-authentication RAD-SERVERS
ip http authentication aaa exec-authorization RAD-SERVERS

Re: WEBconsole Radius Authentication

balaji.bandi — Mon, 12 Feb 2024 15:55:51 GMT

apoliogies, i would have asked this in the first instance, what Device mode and IOS code running on the device.

Re: WEBconsole Radius Authentication

MHM Cisco World — Tue, 13 Feb 2024 18:45:29 GMT

Debug aaa authorization <- share this if @Aref Alsouqi suggested not work for you.

MHM