topic Equivalent Command for 9800 in Wireless

Equivalent Command for 9800

roo54 — Wed, 24 Apr 2024 15:56:19 GMT

A simple question....If I just knew where to find the answer:

Doing MAC authentication on an 5520 WLC, I can see the MAC addresses accepted by the WLC if I issue the command:

"sho macfilter summary"

Can anyone tell me the equivalent command on a 9800 (yes, I have googled it 🙂 )

Thanks

Roo

Re: Equivalent Command for 9800

Mark Elsen — Wed, 24 Apr 2024 16:20:40 GMT

- I don't think your statement is exactly true ; the mentioned command will only list the allowed mac addresses (not authenticating events) ; 'similarly' on the 9800 you follow this document for setup : https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213922-configure-mac-authentication-ssid-on-cis.html
Probably the allowed MAC's can be listed in the running config somewhere afterwards ,

Re: Equivalent Command for 9800

roo54 — Wed, 24 Apr 2024 16:54:57 GMT

That's what I was trying to do, list the allowed MAC addresses....

Re: Equivalent Command for 9800

Mark Elsen — Wed, 24 Apr 2024 17:02:46 GMT

- Yeah , because of the underlying ios-xe being used , my methodology will work , but is more cumbersome to perform ,

Re: Equivalent Command for 9800

roo54 — Wed, 24 Apr 2024 18:23:45 GMT

You wrote " Probably the allowed MAC's can be listed in the running config somewhere afterwards ", that was my first thougt, but looking at the running config did not help....I'll dig somemore, but has ANYONE tried to do this? It would be much more reasonable for the MAC addresses to be managed by an ISE, but not in this case, they are managed by the WLC which seems to have hidden them 🙂

Thanks

Roo

Re: Equivalent Command for 9800

roo54 — Wed, 24 Apr 2024 19:10:14 GMT

OK, I dug it out myself 🙂

the MAC addresses are stored in

Config>Security>AAA>AAA Advanced>MAC Addresses

on the GUI, and if you were hoping to get a CLI command like "sho macfilter summary", I think I'm gonna disapoint you, the nearest I could get was to do "sho runn | beg username", but when you do that the MAC addresses are mixed in amongst the admin users, etc. I guess they don't really want you managing MAC addresses on the WLC, it should be done on an IOSE or similar, and they aren't going to make it easy for you to do it

Thanks

Roo

Re: Equivalent Command for 9800

Rich R — Sun, 28 Apr 2024 20:38:25 GMT

Yes they are saved as usernames of type mac so actually it is quite easy to filter them from running-config with:
show run | inc username ............ mac