topic On the WLAN/Security/AAA in Wireless

Cisco WLAN AAA server question

jwillie3 — Mon, 05 Jul 2021 14:30:23 GMT

I am working on a 7500 WLC with a lot of old RADIUS servers configured. We are in the process of migrating all function from older ACS servers over to ISE.

Under the Security Tab, all AAA RADIUS auth and accounting servers have 'Network user' and 'management' options set.

In the ISE logs, I am seeing messages coming from WLAN's that I don't believe should be sending any accounting info to ISE. The WLAN's are set for using a PSK or in one case, the WLAN is set to open.

On the WLAN/Security/AAA server settings the check boxes for overriding the default AAA server is checked, but in the drop down options those were left to 'none'.

I am assuming that this setup was chosen to try and prevent the WLC from forwarding any AAA accounting data anywhere.

My question is if this is a valid setup or is there another way to get the WLC to not send AAA accounting to ISE for WLAN's that are not doing 802.1X.

-Thanks

On the WLAN/Security/AAA

Rasika Nayanajith — Mon, 07 Aug 2017 20:57:10 GMT

On the WLAN/Security/AAA server settings the check boxes for overriding the default AAA server is checked, but in the drop down options those were left to 'none'.

This is a default setting when you creating a WLAN.

You can untick it if WLAN is Open or PSK SSID.

HTH

Rasika

*** Pls rate all useful responses ***

If you do not want any

patoberli — Tue, 08 Aug 2017 08:36:27 GMT

If you do not want any accounting packets being sent, remove the accounting servers from the WLC.

I guess I should have been

jwillie3 — Tue, 08 Aug 2017 12:59:53 GMT

I guess I should have been more specific in my initial post.

I have other WLAN's on the controller that do use 802.1X and need to send logs to ISE.

Ah ok :)

patoberli — Tue, 08 Aug 2017 13:18:55 GMT

Ah ok 🙂

In that case, go to the specific BSSID and to the security tab and make sure that nothing is selected for accounting. That way no accounting information will be sent for that BSSID to the radius.