topic Re: Catalyst 9800 External WebAuth AAA missing Radius Accounting in Wireless

Catalyst 9800 External WebAuth AAA missing Radius Accounting

Guilherme17849 — Mon, 05 Jul 2021 19:09:05 GMT

I'm facing an issue with external Radius Accounting packages. Running WLC 9800 Catalyst v17.2.1

The webauth prompts to the user (at my external server), got authenticated but after that, I don't receive any Radius Accounting package at my Freeradius.

I've set up Radius server, Radius Server group and AAA under Method List tab, on AAA menu.

Is there any option which should be activated to get it working?

Re: Catalyst 9800 External WebAuth AAA missing Radius Accounting

Rafael E — Tue, 09 Jun 2020 00:25:23 GMT

you need to map the accounting method on the policy profile.

also, make sure you have:

aaa accounting identity <name> start-stop group <RADIUS-group>

Re: Catalyst 9800 External WebAuth AAA missing Radius Accounting

Guilherme17849 — Thu, 09 Jul 2020 02:16:22 GMT

I've done with no success. Still not getting start-stop packages at my Freeradius.

Do you have any other hint?

I'm concerning there's a misconfiguration or a bug at this version of 9800 Catalyst. According to previous versions that I had contact with, at WLAN Layer 3 settings there was an option to select the Accounting method. This option its not appearing to me, as we can see in the following screenshot.

Re: Catalyst 9800 External WebAuth AAA missing Radius Accounting

unsuspecting user — Fri, 11 Sep 2020 07:50:04 GMT

Hello everyone,
I am also looking for the entry where I enter the Accounting Server in the SSID.
It is created under AAA Accounting.

In my opinion you should be able to select it from the Policy List under

Advanced - AAA Policy - Accounting List, but this is empty.

With the WISM it was quite simple in the AAA settings of the SSID with the drop down menu

Maybe I'm on the 9800 but also in a wrong menu.

Hence the question where is the assignment of SSID to the Accounting Server created?

Cisco IOS Software [Gibraltar], C9800 Software (C9800_IOSXE-K9), Version 16.12.3

Re: Catalyst 9800 External WebAuth AAA missing Radius Accounting

Scott Fella — Fri, 11 Sep 2020 08:10:14 GMT

Don’t try to compare between the two as many things have changed. Take a look at the guide for 802.1x

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213919-configure-802-1x-authentication-on-catal.html

Re: Catalyst 9800 External WebAuth AAA missing Radius Accounting

unsuspecting user — Mon, 14 Sep 2020 12:54:02 GMT

Hi, Scott,
i think i have found my problem, it seems to be a bug in the webUI
When I enter the created accounting list via CLI it seems to work with this guide.

see picture

Step 1
Device(config)# wireless profile policy default-policy-profile
Configures WLAN policy profile and enters wireless policy configuration mode.
Step 2
Device(config-wireless-policy)# shutdown
Disables the policy profile.
Step 3
Device(config-wireless-policy)# accounting-list user1-list
Sets the accounting list.
Step 4
Device(config-wireless-policy)# no shutdown
Enables the policy profile.

Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE Amsterdam 17.3.x
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-3/config-guide/b_wl_17_3_cg/m_config_model.html?bookSearch=true

Now I just have to find out the right accounting type for logging to the freeradius-accounting server for the guests in the wlan
i have put on "networks" for testing, but i am not sure if it is the right one.

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/214490-configure-radius-and-tacacs-for-gui-and.html

AAA Accounting Types

Named accounting method lists are specific to the indicated type of accounting.

network --To create a method list to enable authorization for all network-related service requests (including SLIP, PPP, PPP NCPs, and ARAP protocols), use the network keyword. For example, to create a method list that provides accounting information for ARAP (network) sessions, use the arap keyword.
exec --To create a method list that provides accounting records about user EXEC terminal sessions on the network access server, including username, date, start and stop times, use the exec keyword.
commands --To create a method list that provides accounting information about specific, individual EXEC commands associated with a specific privilege level, use the commandskeyword.
connection --To create a method list that provides accounting information about all outbound connections made from the network access server, use the connection keyword.

Re: Catalyst 9800 External WebAuth AAA missing Radius Accounting

Scott Fella — Mon, 14 Sep 2020 13:28:26 GMT

There are a lot of documentation and blogs on aaa references that also show what others might configure or not. Typically I have seen accounting for Tacacs or vpn not much for wireless. You can have multiple in the method list also.