9800wlc-L-F not access http/https access

Ramprasad2 — Thu, 22 Dec 2022 17:26:34 GMT

Hello,

i have a 9800L-F model wlc

i create 2 vlan

1 vlan 17 for management

2 vlan 19 for end user

i have access wlc form management vlan ( https and https )

i have access wlc vlan 19 form lan connectivity but user are connect wifi ssid and same rang ip gate vlan 19 but not access http and https so please help

================================================================

WLC-ZOMATO-1#show running-config
Building configuration...

Current configuration : 15321 bytes
!
! Last configuration change at 21:29:24 IST Thu Dec 22 2022 by konverge
! NVRAM config last updated at 21:34:57 IST Thu Dec 22 2022 by konverge
!
version 17.6
service timestamps debug datetime msec
service timestamps log datetime msec
service call-home
platform qfp utilization monitor load 80
platform punt-keepalive disable-kernel-core
!
hostname WLC-ZOMATO-1
!
boot-start-marker
boot system bootflash:packages.conf
boot system bootflash:/C9800-L-universalk9_wlc.17.03.04c.SPA.bin
boot-end-marker
!
!
vrf definition Mgmt-intf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
enable password Konverge@123
!
no aaa new-model
clock timezone IST 5 30
vtp mode transparent
!
!
!
!
!
!
!
!
!
!
login on-success log
!
!
!
!
!
!
!
subscriber templating
!
!
!
!
!
!
parameter-map type webauth global
type webauth
virtual-ip ipv4 1.1.1.1
banner title ^Cwel^C
!
access-session mac-move deny
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
crypto pki trustpoint SLA-TrustPoint
enrollment pkcs12
revocation-check crl
!
crypto pki trustpoint TP-self-signed-275080374
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-275080374
revocation-check none
rsakeypair TP-self-signed-275080374
!
!
crypto pki certificate chain SLA-TrustPoint
certificate ca 01
30820321 30820209 A0030201 02020101 300D0609 2A864886 F70D0101 0B050030
32310E30 0C060355 040A1305 43697363 6F312030 1E060355 04031317 43697363
6F204C69 63656E73 696E6720 526F6F74 20434130 1E170D31 33303533 30313934
3834375A 170D3338 30353330 31393438 34375A30 32310E30 0C060355 040A1305
43697363 6F312030 1E060355 04031317 43697363 6F204C69 63656E73 696E6720
526F6F74 20434130 82012230 0D06092A 864886F7 0D010101 05000382 010F0030
82010A02 82010100 A6BCBD96 131E05F7 145EA72C 2CD686E6 17222EA1 F1EFF64D
CBB4C798 212AA147 C655D8D7 9471380D 8711441E 1AAF071A 9CAE6388 8A38E520
1C394D78 462EF239 C659F715 B98C0A59 5BBB5CBD 0CFEBEA3 700A8BF7 D8F256EE
4AA4E80D DB6FD1C9 60B1FD18 FFC69C96 6FA68957 A2617DE7 104FDC5F EA2956AC
7390A3EB 2B5436AD C847A2C5 DAB553EB 69A9A535 58E9F3E3 C0BD23CF 58BD7188
68E69491 20F320E7 948E71D7 AE3BCC84 F10684C7 4BC8E00F 539BA42B 42C68BB7
C7479096 B4CB2D62 EA2F505D C7B062A4 6811D95B E8250FC4 5D5D5FB8 8F27D191
C55F0D76 61F9A4CD 3D992327 A8BB03BD 4E6D7069 7CBADF8B DF5F4368 95135E44
DFC7C6CF 04DD7FD1 02030100 01A34230 40300E06 03551D0F 0101FF04 04030201
06300F06 03551D13 0101FF04 05300301 01FF301D 0603551D 0E041604 1449DC85
4B3D31E5 1B3E6A17 606AF333 3D3B4C73 E8300D06 092A8648 86F70D01 010B0500
03820101 00507F24 D3932A66 86025D9F E838AE5C 6D4DF6B0 49631C78 240DA905
604EDCDE FF4FED2B 77FC460E CD636FDB DD44681E 3A5673AB 9093D3B1 6C9E3D8B
D98987BF E40CBD9E 1AECA0C2 2189BB5C 8FA85686 CD98B646 5575B146 8DFC66A8
467A3DF4 4D565700 6ADF0F0D CF835015 3C04FF7C 21E878AC 11BA9CD2 55A9232C
7CA7B7E6 C1AF74F6 152E99B7 B1FCF9BB E973DE7F 5BDDEB86 C71E3B49 1765308B
5FB0DA06 B92AFE7F 494E8A9E 07B85737 F3A58BE1 1A48A229 C37C1E69 39F08678
80DDCD16 D6BACECA EEBC7CF9 8428787B 35202CDC 60E4616A B623CDBD 230E3AFB
418616A9 4093E049 4D10AB75 27E86F73 932E35B5 8862FDAE 0275156F 719BB2F0
D697DF7F 28
quit
crypto pki certificate chain TP-self-signed-275080374
certificate self-signed 01
3082032E 30820216 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
30312E30 2C060355 04031325 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 32373530 38303337 34301E17 0D313730 31303731 34353931
305A170D 32373031 30373134 35393130 5A303031 2E302C06 03550403 1325494F
532D5365 6C662D53 69676E65 642D4365 72746966 69636174 652D3237 35303830
33373430 82012230 0D06092A 864886F7 0D010101 05000382 010F0030 82010A02
82010100 CE27BB6C C2A37AF7 3DE604C2 3A37D02B B06FCB7A 6A6D1050 12E0BE12
7B093D73 F18EA011 235D5D5A AA79F4FA 6AA8FEDC 9FAA766B 7A1A769D 64A95BB1
EEE04E31 8DBDFCFB 06F0E6F9 42D0F5DA 3566124E 13978E65 A8ADC852 E4068754
C2C1CB6D BEA7FD89 7946DF14 425DCB32 88D75FE2 C69F21B9 D1707870 9D371777
63CD2D39 3FD8CE02 D6430F36 9053FB77 24E3793B 94FB5423 3CAE873D 98FCD934
C28B327A F507E266 9B8827C7 706E077C 0D4B4907 0D9FE413 D80EB851 46470AB1
BFAB71C0 DAD562F0 37AFAD0B A61CA6AC C455AF1B EC34F577 3E2B82CC E2125D49
F49EFAF4 66C76E21 8827AC49 A45F16B9 6571BC91 7B40D71E 6CDB159C 81E245BE
7340F275 02030100 01A35330 51300F06 03551D13 0101FF04 05300301 01FF301F
0603551D 23041830 168014B8 329D61CF 778DAAB9 5FF11E72 10FF21DE CC263D30
1D060355 1D0E0416 0414B832 9D61CF77 8DAAB95F F11E7210 FF21DECC 263D300D
06092A86 4886F70D 01010505 00038201 01007E82 EB207269 032EC7E3 811C630B
982F2D6E 3FFA2F46 7880E426 5D1CCA91 6771CDD9 4126A450 01A8DF28 EB4EC122
C928CBAB 59B34E52 D38AC6B4 B67EA822 C0988FF1 9E808FE3 61240CEB 4B894F56
99AF1A28 6BC03D01 B8033AEE C0F97C98 3DFAA4CF 528C1259 4D54AB4C 6FA58D99
5A17E5BE CE5DA0DB BBD79E85 3573CD75 0CCD8F05 E92A83A6 0A2F46CF ED222D87
2F617C31 794D6F13 0E0D3AB7 9F47826D 39FAF872 338BE63B 486908F0 A3936C7B
EBFC100C BF9B08C2 367966E6 2AB0BC8D 480AF83D 0FFC1268 866A1913 4C51E951
9EBDE027 364AAD32 3C7A0893 C4EE8D7F BB6C2296 B752F712 03D19015 F1334748
197F64BF 98B0816D EBAC8BC3 3B1E1755 8706
quit
!
!
license udi pid C9800-L-F-K9 sn FCL264100SJ
memory free low-watermark processor 170271
!
service-template DEFAULT_LINKSEC_POLICY_MUST_SECURE
linksec policy must-secure
service-template DEFAULT_LINKSEC_POLICY_SHOULD_SECURE
linksec policy should-secure
service-template DEFAULT_CRITICAL_VOICE_TEMPLATE
voice vlan
service-template DEFAULT_CRITICAL_DATA_TEMPLATE
service-template webauth-global-inactive
inactivity-timer 3600
diagnostic bootup level minimal
!
username konverge privilege 15 password 0 Konverge@123
!
redundancy
mode sso
!
!
!
!
!
vlan internal allocation policy ascending
!
vlan 10
name DMZ
!
vlan 17
name MGMT
!
vlan 18
name Eternal_IT
!
vlan 19
name Eternal
!
vlan 20
name Eternal_Phone
!
vlan 21
name Wired
!
vlan 22
name Eternal_Guest
!
vlan 50
name Spare_VLAN_1
!
vlan 51
name Spare_VLAN_2
!
!
!
class-map match-any AVC-Reanchor-Class
match protocol cisco-jabber-audio
match protocol cisco-jabber-video
match protocol webex-media
match protocol webex-app-sharing
match protocol webex-control
match protocol webex-meeting
match protocol wifi-calling
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface TwoGigabitEthernet0/0/0
switchport mode access
negotiation auto
no snmp trap link-status
!
interface TwoGigabitEthernet0/0/1
description conect test_only
switchport access vlan 17
switchport mode access
negotiation auto
no snmp trap link-status
!
interface TwoGigabitEthernet0/0/2
negotiation auto
no snmp trap link-status
!
interface TwoGigabitEthernet0/0/3
negotiation auto
no snmp trap link-status
!
interface TenGigabitEthernet0/1/0
no negotiation auto
no snmp trap link-status
!
interface TenGigabitEthernet0/1/1
description Connect to core switch TenG1/0/10
switchport mode trunk
no negotiation auto
no snmp trap link-status
!
interface GigabitEthernet0
vrf forwarding Mgmt-intf
no ip address
negotiation auto
!
interface Vlan1
ip address 192.168.10.10 255.255.255.0
!
interface Vlan17
description MGMT_SVI
ip address 10.200.200.36 255.255.254.0
!
no ip http server
ip http authentication local
ip http secure-server
ip http secure-trustpoint TP-self-signed-275080374
ip http client source-interface Vlan1
ip forward-protocol nd
!
ip route 0.0.0.0 0.0.0.0 10.200.201.253
!
!
!
!
!
!
control-plane
!
!
!
!
!
!
line con 0
stopbits 1
line aux 0
line vty 0 4
password Konverge@123
login local
length 0
transport input all
line vty 5 15
login
transport input ssh
!
call-home
! If contact email address in call-home is configured as sch-smart-licensing@cisco.com
! the email address configured in Cisco Smart License Portal will be used as contact email address to send SCH notifications.
contact-email-addr sch-smart-licensing@cisco.com
profile "CiscoTAC-1"
active
destination transport-method http
!
!
!
!
!
redun-management interface Vlan1 chassis 1 address 10.200.200.37 chassis 2 address 10.200.200.38
!
wireless aaa policy default-aaa-policy
wireless cts-sxp profile default-sxp-profile
wireless management certificate ssc auth-token 0 Konverge@123
wireless management interface Vlan17
wireless profile airtime-fairness default-atf-policy 0
wireless profile flex Flex-P-Retail-1F
ip http client proxy 0.0.0.0 0
native-vlan-id 17
vlan-name MGMT
vlan-id 17
vlan-name Eternal
vlan-id 19
local-roaming
wireless profile flex Retail-building-1F
ip http client proxy 0.0.0.0 0
native-vlan-id 17
vlan-name MGMT
vlan-id 17
vlan-name Eternal
vlan-id 19
local-roaming
wireless profile flex default-flex-profile
description "default flex profile"
ip http client proxy 0.0.0.0 0
native-vlan-id 17
wireless profile mesh default-mesh-profile
description "default mesh profile"
wireless profile radio 5Ghz--profile
antenna count 0
description 5Ghz--profile
wireless profile radio default-radio-profile
description "Preconfigured default radio profile"
wireless profile policy Policy-P-Retail-1F
no central authentication
no central dhcp
no central switching
description Policy-P-Retail-1F
dhcp-tlv-caching
et-analytics enable
flex vlan-central-switching
http-tlv-caching
ipv4 dhcp required
ipv4 dhcp server 10.100.16.1
passive-client
vlan Eternal
no shutdown
wireless profile policy default-policy-profile
description "default policy profile"
dhcp-tlv-caching
http-tlv-caching
passive-client
radius-profiling
vlan Eternal
no shutdown
wireless tag site default-site-tag
description "default site tag"
fabric control-plane default-control-plane
flex-profile Retail-building-1F
no local-site
wireless tag site Site-Tage-Retail-1F
ap-profile AP-Join-P-Retail-1F
description Site-Tage-Retail-1F
fabric control-plane default-control-plane
flex-profile Flex-P-Retail-1F
no local-site
wireless tag policy default-policy-tag
wlan Test-R policy default-policy-profile
wlan Eternal policy default-policy-profile
wlan Eternal-R policy default-policy-profile
wireless tag policy Policy-Tag-Retail-1F
wlan Test-R policy Policy-P-Retail-1F
wlan Eternal policy Policy-P-Retail-1F
wlan Eternal-R policy Policy-P-Retail-1F
wireless tag rf 5Gz-RF-tag
5ghz-rf-policy 5GHz
wireless tag rf default-rf-tag
description "default RF tag"
wireless wps rogue ap init-timer 60
wireless wps rogue ap rldp alarm-only monitor-ap-only
wireless wps rogue security-level high
wireless fabric control-plane default-control-plane
wireless country IN
wlan Test-R 2 Test-R
ccx aironet-iesupport
load-balance
radio policy dot11 5ghz
security wpa psk set-key ascii 0 Admin@123
no security wpa akm dot1x
security wpa akm psk
no shutdown
wlan Eternal 1 Eternal
no broadcast-ssid
ccx aironet-iesupport
radio policy dot11 5ghz
security wpa psk set-key ascii 0 Eternal@123
no security wpa akm dot1x
security wpa akm psk
wlan Eternal-R 3 Eternal-R
ccx aironet-iesupport
load-balance
radio policy dot11 5ghz
security wpa psk set-key ascii 0 Admin@123
no security wpa akm dot1x
security wpa akm psk
universal-ap-admin
no shutdown
ap dot11 24ghz rf-profile Low_Client_Density_rf_24gh
coverage data rssi threshold -90
coverage level 2
coverage voice rssi threshold -90
description "pre configured Low Client Density rfprofile for 2.4gh radio"
high-density rx-sop threshold low
rate RATE_12M supported
rate RATE_24M supported
rate RATE_6M supported
tx-power v1 threshold -65
no shutdown
ap dot11 24ghz rf-profile High_Client_Density_rf_24gh
description "pre configured High Client Density rfprofile for 2.4gh radio"
high-density rx-sop threshold medium
rate RATE_11M disable
rate RATE_12M mandatory
rate RATE_1M disable
rate RATE_24M supported
rate RATE_2M disable
rate RATE_5_5M disable
rate RATE_6M disable
tx-power min 7
no shutdown
ap dot11 24ghz rf-profile Typical_Client_Density_rf_24gh
description "pre configured Typical Client Density rfprofile for 2.4gh radio"
rate RATE_11M disable
rate RATE_12M mandatory
rate RATE_1M disable
rate RATE_24M supported
rate RATE_2M disable
rate RATE_5_5M disable
rate RATE_6M disable
no shutdown
ap dot11 24ghz rrm channel cleanair-event
ap dot11 24ghz rrm channel cleanair-event rogue-contribution
ap dot11 24ghz cleanair alarm air-quality
ap dot11 24ghz cleanair alarm device
ap dot11 24ghz shutdown
ap dot11 24ghz rate RATE_12M supported
ap dot11 24ghz rate RATE_24M supported
ap dot11 24ghz rate RATE_6M supported
ap dot11 5ghz rf-profile 5GHz
channel chan-width 40
coverage data rssi threshold -65
coverage voice rssi threshold -65
description 5GHz
hsr-mode
rate RATE_12M disable
rate RATE_18M mandatory
rate RATE_24M supported
rate RATE_6M disable
rate RATE_9M disable
no shutdown
ap dot11 5ghz rf-profile Low_Client_Density_rf_5gh
coverage data rssi threshold -90
coverage level 2
coverage voice rssi threshold -90
description "pre configured Low Client Density rfprofile for 5gh radio"
high-density rx-sop threshold low
rate RATE_12M mandatory
rate RATE_24M mandatory
rate RATE_6M mandatory
tx-power v1 threshold -60
no shutdown
ap dot11 5ghz rf-profile High_Client_Density_rf_5gh
description "pre configured High Client Density rfprofile for 5gh radio"
high-density rx-sop threshold medium
rate RATE_12M mandatory
rate RATE_24M mandatory
rate RATE_6M disable
rate RATE_9M disable
tx-power min 7
tx-power v1 threshold -65
no shutdown
ap dot11 5ghz rf-profile Typical_Client_Density_rf_5gh
description "pre configured Typical Density rfprofile for 5gh radio"
rate RATE_12M mandatory
rate RATE_24M mandatory
rate RATE_6M mandatory
no shutdown
ap dot11 5ghz rrm channel cleanair-event
ap dot11 5ghz rrm channel cleanair-event rogue-contribution
ap dot11 5ghz edca-parameters fastlane
ap dot11 5ghz rate RATE_12M disable
ap dot11 5ghz rate RATE_18M mandatory
ap dot11 5ghz rate RATE_24M supported
ap dot11 5ghz rate RATE_6M disable
ap dot11 5ghz rate RATE_9M disable
ap country IN
ap fra
ap tag-source-priority 2 source filter
ap tag-source-priority 3 source ap
ap location name Retail-building-1F
ap-eth-mac 889c.ad4a.b720
ap-eth-mac 889c.ad4b.7ba4
ap-eth-mac 889c.ad4b.bcac
ap-eth-mac 889c.ad4b.d2c8
ap-eth-mac 889c.ad4b.d7b8
ap-eth-mac 889c.ad4b.dfd4
ap-eth-mac 889c.ad4b.e45c
ap-eth-mac 889c.ad4b.f6b4
ap-eth-mac 889c.ad4b.ffa4
ap-eth-mac 889c.ad4c.13cc
ap-eth-mac 889c.ad4c.1f2c
description Retail-building
tag policy Policy-Tag-Retail-1F
tag rf 5Gz-RF-tag
tag site Site-Tage-Retail-1F
ap profile default-ap-profile
country IN
description "default ap profile"
ntp ip 0.0.0.0
rogue detection containment auto-rate
rogue detection min-rssi -80
rogue detection min-transient-time 300
rogue detection report-interval 30
syslog host 255.255.255.255
ap profile AP-Join-P-Retail-1F
country IN
description AP-Join-P-Retail-1F
link-latency
mgmtuser username Ap2 password 0 Admin@123 secret 0 Admin@123
ntp ip 0.0.0.0
preferred-mode ipv4
rogue detection min-rssi -80
ssh
statistics ap-system-monitoring alarm-enable
statistics ap-system-monitoring enable
syslog host 255.255.255.255
ap 889c.ad4b.7ba4
policy-tag Policy-Tag-Retail-1F
rf-tag 5Gz-RF-tag
site-tag Site-Tage-Retail-1F
trapflags ap crash
trapflags ap noradiocards
trapflags ap register
end

WLC-ZOMATO-1#
WLC-ZOMATO-1#

-------------------------------------

Re: 9800wlc-L-F not access http/https access

balaji.bandi — Thu, 22 Dec 2022 17:46:15 GMT

vlan 19 but not access http and https - we are not able to understand this, are you looking from VLAN to access WLC http and https ?

or internet ?

if internet is the issue - you need to look at the route going to device having IP 10.200.201.253 ( check routing back and NAT for RFC1918 addressing)

Re: 9800wlc-L-F not access http/https access

Mark Elsen — Thu, 22 Dec 2022 18:06:18 GMT

- Review the configuration of the 9800L-F controller with the CLI command show tech wireless , have the output analyzed by https://cway.cisco.com/tools/WirelessAnalyzer/ , please note do not use classical show tech-support (short version) , use the command denoted in green for Wireless Analyzer. Checkout all advisories! Also note that all advisories red-flagged should be corrected!!

Re: 9800wlc-L-F not access http/https access

Ramprasad2 — Thu, 22 Dec 2022 18:23:33 GMT

I have a Catalyst 9800 L-F in a test environement with three 9120 APs in Flex mode. I have enabled "wireless mgmt-via-wireless". But when I am connected over wireless with a client that is connected in the same vlan ( vlan1) as the controller I can´t access the controller itself. All other IPs within the network are reachable.

When I am connected via cable - everything is working fine.

Do you have an idea what is going worng?

Re: 9800wlc-L-F not access http/https access

MHM Cisco World — Thu, 22 Dec 2022 18:39:11 GMT

wireless mgmt-via-wireless <<<- need this

Re: 9800wlc-L-F not access http/https access

Ramprasad2 — Thu, 22 Dec 2022 18:47:42 GMT

it has configured already

Re: 9800wlc-L-F not access http/https access

Scott Fella — Thu, 22 Dec 2022 21:42:58 GMT

You running FlexConnect? CSCvu29200 : Bug Search Tool (cisco.com)

Re: 9800wlc-L-F not access http/https access

MHM Cisco World — Fri, 23 Dec 2022 12:30:48 GMT

no ip http server <- can you enable http it can that user use http not https

Re: 9800wlc-L-F not access http/https access

aneesap90 — Thu, 13 Nov 2025 14:12:34 GMT

Hi Brother,

How did you fix this issue ? I am having the same issue

topic Re: 9800wlc-L-F not access http/https access in Wireless

9800wlc-L-F not access http/https access

Re: 9800wlc-L-F not access http/https access

Re: 9800wlc-L-F not access http/https access

Re: 9800wlc-L-F not access http/https access

Re: 9800wlc-L-F not access http/https access

Re: 9800wlc-L-F not access http/https access

Re: 9800wlc-L-F not access http/https access

Re: 9800wlc-L-F not access http/https access

Re: 9800wlc-L-F not access http/https access