topic Re: C9800 wlc Mgmtuser encrypt password in Wireless

C9800 wlc Mgmtuser encrypt password

Charlie Grey — Fri, 29 Mar 2024 12:45:13 GMT

hi,

the mgmtuser username password defined in my AP join policy show in clear text and cannot be encrypted.

when i exe the command,

mgmtuser username admin password 8 mypass123 secret 8 mysecret123

always get error %password encryption failed: possible mismatch of password type & secret type!

i really pulling my hair out clueless.

C9800 controller running 17.9.4a.

anyone?

Re: C9800 wlc Mgmtuser encrypt password

balaji.bandi — Fri, 29 Mar 2024 12:52:34 GMT

check below thread may help you :

https://community.cisco.com/t5/wireless/9800-wlc-wpa2-pre-shared-key-not-working-after-uploading-config/td-p/4531728

Re: C9800 wlc Mgmtuser encrypt password

Mark Elsen — Fri, 29 Mar 2024 13:12:26 GMT

- Run error through Cisco's bug search tool (use google to find). Select correct platform too.

A trick I often use ; use google advanced search. Paste error in second input field. On the primary field type "solved" "cisco" or less , depending on the number of results ,

Re: C9800 wlc Mgmtuser encrypt password

Karsten Iwen — Fri, 29 Mar 2024 13:23:04 GMT

You are using the wrong syntax to activate the encryption. The command you used needs the AES encrypted password, not the plaintext one. If the passwords show in clear, you have not yet enabled password-encryption:

password encryption aes key config-key password-encrypt THIS-IS-YOUR-COMPLEX-ENCRYPT-PASSWORD

After you configure this, the passwords are not visible any more in clear.

Re: C9800 wlc Mgmtuser encrypt password

Charlie Grey — Fri, 29 Mar 2024 13:46:18 GMT

i already went thru that post before i post here to ask.

i am not restoring from old config.

i already have password encryption aes enabled w the master key configured.

Re: C9800 wlc Mgmtuser encrypt password

Charlie Grey — Fri, 29 Mar 2024 14:03:31 GMT

not working.

i already have the below 2 commands configured.

password encryption aes

key config-key password-encrypt THIS-IS-YOUR-COMPLEX-ENCRYPT-PASSWORD

i then run the below command also not working

mgmtuser username admin password 0 mypass123 secret 0 mysecret123

do i need to write mem before the encryption take effect?

Re: C9800 wlc Mgmtuser encrypt password

Mark Elsen — Fri, 29 Mar 2024 16:57:17 GMT

- Possible configuration conflicts may lead to this , check with the CLI command show tech wireless and feed the output to : Wireless Config Analyzer

Re: C9800 wlc Mgmtuser encrypt password

Mark Elsen — Fri, 29 Mar 2024 17:15:16 GMT

>...do i need to write mem before the encryption take effect?
Could be because the master key is saved separately in a secure part of NVRAM and not backed up.

Re: C9800 wlc Mgmtuser encrypt password

Karsten Iwen — Fri, 29 Mar 2024 17:30:17 GMT

What happens when you set the user account with type 0?

Re: C9800 wlc Mgmtuser encrypt password

Charlie Grey — Fri, 29 Mar 2024 18:17:58 GMT

the key is show in clear text in config as below -

mgmtuser username admin password 0 mypass123 secret 0 mysecret123

Re: C9800 wlc Mgmtuser encrypt password

Charlie Grey — Sat, 30 Mar 2024 03:38:38 GMT

Question -

can (should) the password of mgmtuser username command be encryption using Type 6??

how come i run the ? of the command it show 0 and 8??

Re: C9800 wlc Mgmtuser encrypt password

Karsten Iwen — Sat, 30 Mar 2024 08:05:49 GMT

It is Type 8 for the mgmtuser. But this is a different type 8 compared to the regular user accounts.

Re: C9800 wlc Mgmtuser encrypt password

Karsten Iwen — Sat, 30 Mar 2024 11:22:25 GMT

I would open a TAC case. Although it is a suggested release, there still could be something going wrong. The shown way is how it works for me. I don’t even have to reenter the mgmtuser, the actual passwords get directly encrypted.