topic Re: Cisco 9800 Web Admin/GUI Session Timeout in Wireless

Cisco 9800 Web Admin/GUI Session Timeout

Skjoedt — Wed, 27 Sep 2023 09:35:01 GMT

Hello

Does anybody know of a way to extend the Web Admin/GUI Session Timeout beyond 1200 sec. (20 min.) on a Cisco 9800 Wireless Controller?

The customer also has Cisco ISE and uses TACACS, but setting the timeout and idle timeout values in the TACACS profile has not helped with the issue.

Best Regards
Frederik

Re: Cisco 9800 Web Admin/GUI Session Timeout

Mark Elsen — Wed, 27 Sep 2023 10:05:27 GMT

- According to : https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/config-guide/b_wl_16_10_cg/wireless-web-authentication.html you can't :
>...Configuring the HTTP/HTTPS Server (GUI)
>...

Step 8

Enter the number of minutes of inactivity allowed before the session times out. Valid values can range from 180 to 1200 seconds.

Re: Cisco 9800 Web Admin/GUI Session Timeout

balaji.bandi — Wed, 27 Sep 2023 10:24:26 GMT

Web Admin/GUI Session Timeout beyond 1200 sec. (20 min.) on a Cisco 9800 Wireless Controller?

This kicks in inactivity allowed before the session times out, for security reason this is reasonable if none of work doing 20minutes.

May be if your customer looking more time then - cisco wish list.

Re: Cisco 9800 Web Admin/GUI Session Timeout

Mark Elsen — Wed, 27 Sep 2023 10:27:27 GMT

- Actually what you may try is this in the vty part of the running config :
line vty 0 4
exec-timeout 0 0
Check if that makes a difference

Re: Cisco 9800 Web Admin/GUI Session Timeout

Skjoedt — Wed, 27 Sep 2023 12:12:34 GMT

Hello marce1000

Thank you, i have tried to configure this and will let the customer test, however i doubt this will affect the GUI, since vty should only be for CLI purposes...

I will get back with the results...

Re: Cisco 9800 Web Admin/GUI Session Timeout

Mark Elsen — Wed, 27 Sep 2023 12:50:00 GMT

-Negative , the GUI also uses 'vty slots' on the 9800.

M.

Re: Cisco 9800 Web Admin/GUI Session Timeout

Skjoedt — Wed, 27 Sep 2023 14:23:11 GMT

Hello marce1000

Ahh ok, interesting!

I will have the customer test and get back to you 🙂

Best Regards

Re: Cisco 9800 Web Admin/GUI Session Timeout

Skjoedt — Fri, 29 Sep 2023 12:02:46 GMT

Hello marce1000

The customer has now tested and reported that he is still connected after 40min...
However, when i test the same with my own 9800-CL at home, i am not able to hold the session even though i have configured the same... 😞

I logged in at 13:00 and at 13:55 i tried browsing from a configuration page to the dashboard and i got a message that my session had timed out... 😞

9800-CL#sh run | s line
line con 0
stopbits 1
line vty 0 4
exec-timeout 60 0
authorization exec VTY-AuthZ
login authentication VTY-AuthC
length 0
transport input ssh
line vty 5 15
exec-timeout 60 0
authorization exec VTY-AuthZ
login authentication VTY-AuthC
transport input ssh
9800-CL#

Best Regards
Frederik

Re: Cisco 9800 Web Admin/GUI Session Timeout

Skjoedt — Fri, 29 Sep 2023 12:08:39 GMT

Hello marce1000

Also, when i am logged on to CLI with SSH and do a "show users" i see 1 user.
After i have logged on to the Web GUI, i do not see 2 users when doing a "show users".
- I still only see one user... 😞

Best Regards
Frederik

Re: Cisco 9800 Web Admin/GUI Session Timeout

Mark Elsen — Fri, 29 Sep 2023 12:22:35 GMT

- Leaving the output of show users 'in the middle' ; for me on my test cloud controller in eve-ng it works too (not being logged out from the GUI) ; perhaps there is a version difference between your cloud's controller version and IOS-XE version that the customer is using : let's say -> as long as the customer is happy! (smile)

Re: Cisco 9800 Web Admin/GUI Session Timeout

Mark Elsen — Fri, 29 Sep 2023 12:37:44 GMT

@Skjoedt FYI (on VTY) : https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9800-series-wireless-controllers/guide-c07-743627.html#WebuserinterfaceWebUI

Re: Cisco 9800 Web Admin/GUI Session Timeout

Skjoedt — Fri, 29 Sep 2023 12:37:59 GMT

Hello marce1000

That is true, i am on 17.6.5, while the customer is on 17.9.4. 🙂

I have enquired as to how the customer has tested to see if there is a difference in testing methodology 🙂

Best Regards
Frederik

Re: Cisco 9800 Web Admin/GUI Session Timeout

Skjoedt — Fri, 29 Sep 2023 12:41:33 GMT

Hello marce1000

Nice, i have not seen that section of the best practices guide!
Thank you for linking it to me! 🙂

I will go through it, test/revise and get back to you 🙂

Best Regards
Frederik

Re: Cisco 9800 Web Admin/GUI Session Timeout

Skjoedt — Fri, 29 Sep 2023 13:48:32 GMT

Hello marce1000

UPDATE!
It seems to work perfectly for the SSH session though, i got a message in my putty session that i had been disconnected/timed out at exactly 15:45 after my last action was to "write memory" at 14:45 😄 😄
UPDATE!

Hmm... Setting the Exec timeout to 60min on VTY line 0 to 50 and at the same time disabling the Dashboard Session timeout did not work for me on my 9800-CL at home...
I logged in at 14:45 and at 15:38 i tried to browse from the Administration -> Management -> HTTP/HTTPS/Netconf/VTY page to the dashboard and i had to login again... 😞

It seems that the only way is to disable Dashboard Session timeout and then leave your session idling on the dashboard in order to have it refresh every 30sec and keep the session alive... 😞

Best Regards
Frederik

Re: Cisco 9800 Web Admin/GUI Session Timeout

Scott Fella — Fri, 29 Sep 2023 14:07:11 GMT

I will be honest, I have never been able to match the timeouts with ssh. Seems like a good feature to at least specify for http/https connection. Usually is either you enable session timeout or disable it for the dashboard.

Re: Cisco 9800 Web Admin/GUI Session Timeout

Skjoedt — Fri, 29 Sep 2023 14:29:34 GMT

Hello Scott Fella

Thank you for your input.
It seems to me that you have the same experience as me, with regards to web gui session timeout... 😞

Best Regards
Frederik

Re: Cisco 9800 Web Admin/GUI Session Timeout

Scott Fella — Fri, 29 Sep 2023 15:18:16 GMT

That is correct. Now, I never wanted to define a timeout on the GUI for myself, but I can see customers whom want to make sure the GUI timeout is enforced. So how do you not allow users to disable the dashboard timeout if they are admins. Its a good question that you have, I just don't think many folks have hit that requirement or maybe the default is okay for them.