topic Re: Cannot login to WLC 9800 GUI using Radius in Wireless

Cannot login to WLC 9800 GUI using Radius

Moudar — Wed, 23 Oct 2024 11:30:51 GMT

Hi,

We are currently using RADIUS (ISE) for authentication, and while we can successfully log into the CLI of our Cisco 9800 via the AAA server, we encounter a "Wrong Credentials. Please Login again." message when attempting to log into the GUI.

The logs on ISE indicate "5200 Authentication succeeded."

For reference, logging into the GUI using a local account works without any issues.

WLC#sh run | in http ip http server ip http secure-server destination transport-method http

so any ideas?

Re: Cannot login to WLC 9800 GUI using Radius

Mark Elsen — Wed, 23 Oct 2024 11:42:19 GMT

- Do you have the radius server configured to return av pair with priv levels 15 ?

Re: Cannot login to WLC 9800 GUI using Radius

Moudar — Wed, 23 Oct 2024 12:53:44 GMT

It works now adding "aaa authorization exec default group RADIUS_AUTH" to the aaa configuration

I don't realy understand why adding that line would allow aaa to GUI, when login to CLI it goes directly to #mode

Re: Cannot login to WLC 9800 GUI using Radius

Moudar — Wed, 23 Oct 2024 12:51:36 GMT

do we need to add anything else ? for web auth.

Re: Cannot login to WLC 9800 GUI using Radius

Rich R — Thu, 24 Oct 2024 18:05:14 GMT

You should have a good read through https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/214490-configure-radius-and-tacacs-for-gui-and.html

Re: Cannot login to WLC 9800 GUI using Radius

Moudar — Sat, 26 Oct 2024 10:35:05 GMT

This configuration works well:

aaa authentication login default group RADIUS_AUTH local line aaa authentication dot1x default group RADIUS_AUTH aaa authorization exec default-web group RADIUS_AUTH local aaa authorization network default group RADIUS_AUTH aaa accounting exec default start-stop group RADIUS_AUTH ip http authentication aaa login-authentication default ip http authentication aaa exec-authorization default-web

It needed to understand the concept of "Method lists"