topic Re: 9800-L-C AAA not working for HTTPS but works for SSHv2 in Wireless

9800-L-C AAA not working for HTTPS but works for SSHv2

Eric House — Mon, 04 May 2026 16:12:00 GMT

Cisco 9800-L-C running IOS XE 17.15.5, using Cisco ISE 3.4 for TACACS+. AAA is working flawlessly for SSH authentication and authorization, good logs on both sides. When I change from local to AAA for IP HTTPS secure-server, the webgui fails to load, giving the Openresty error page. ISE logs show successful authentication and authorization entries with authorization response {Author-Reply-Status=PassAdd; AVPair=priv-lvl=15; } giving the correct privilege level 15. If a wrong password is entered, the webgui responds with a failed authentication message and returns to logon prompt. Is something acting wrong or did I miss an additional config change needed to make AAA work with the webgui?

Working local auth config:
ip http authentication local

Fails when I configure for TACACS:
aaa authentication login NAME group GROUP local
aaa authorization exec NAME group GROUP local
ip http authentication aaa login-authentication NAME
ip http authentication aaa exec-authorization NAME

TACACS debug from switch returns:
May 1 17:09:49.990: %SEC_LOGIN-5-WEBLOGIN_SUCCESS: Login Success [user: USERNAME] [Source: xx.xx.xx.xx] at 12:09:49 CST Fri May 1 2026
May 1 17:09:49.991: %WEBSERVER-5-LOGIN_PASSED: Chassis 2 Login Successful from host xx.xx.xx.xx by user 'USERNAME' using crypto cipher 'TLS_AES_256_GCM_SHA384'

Failure message when trying webgui with AAA:
An error occurred.
Sorry, the page you are looking for is currently unavailable.
Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Faithfully yours, OpenResty.

Re: 9800-L-C AAA not working for HTTPS but works for SSHv2

Mark Elsen — Mon, 04 May 2026 16:32:23 GMT

= @Eric House >....giving the Openresty error page
Can you post the content of that error page (or screenshot -e.g.)

Re: 9800-L-C AAA not working for HTTPS but works for SSHv2

Eric House — Mon, 04 May 2026 16:38:39 GMT

Image attached, hopefully it sheds some light, thank you.

Re: 9800-L-C AAA not working for HTTPS but works for SSHv2

Mark Elsen — Mon, 04 May 2026 16:45:08 GMT

- @Eric House Can you post the output of : show run | inc ip http

Re: 9800-L-C AAA not working for HTTPS but works for SSHv2

Eric House — Mon, 04 May 2026 17:01:21 GMT

HOSTNAME#sh run | inc ip http
no ip http server
ip http authentication aaa login-authentication NAME
ip http authentication aaa exec-authorization NAME
ip http secure-server
ip http tls-version TLSv1.3
ip http secure-trustpoint NGTNWLNASH.ng.ds.army.mil
ip http session-idle timeout 300
ip http client source-interface vlan###

If I replace the authentication aaa lines with local, it works with the local user.

Re: 9800-L-C AAA not working for HTTPS but works for SSHv2

Htonieto — Mon, 04 May 2026 17:05:33 GMT

Hello @Eric House, just checked mine 9800, which is running 17.15.04d, the only difference is this line.

ip http authentication aaa

Also ISE response is pretty the same

Model Name 9800 Network Device Profile Cisco Response {Author-Reply-Status=PassAdd; AVPair=idletime=15; AVPair=priv-lvl=15; AVPair=timeout=60; }

Do you mind to enable some debugs in the WLC and try the auth again? Please share the logs.

debug aaa authentication debug aaa authorization debug tacacs debug ip http authentication

Re: 9800-L-C AAA not working for HTTPS but works for SSHv2

Mark Elsen — Mon, 04 May 2026 17:10:32 GMT

- @Eric House In that screenshot is : >....you should check the error log for details
That is a link (error log) ; could you post the resulting content when pressing the link

Re: 9800-L-C AAA not working for HTTPS but works for SSHv2

aleabrahao — Mon, 04 May 2026 17:12:47 GMT

This is my authorization policy.

This is my configuration on the WLC.

ip http authentication aaa login-authentication tacacs-authe
ip http authentication aaa exec-authorization tacacs_autho

Re: 9800-L-C AAA not working for HTTPS but works for SSHv2

Eric House — Mon, 04 May 2026 17:15:44 GMT

It doesn't, it directs to https://nginx.org/en/docs/ngx_core_module.html#error_log

The logs in ISE and in the wireless controller's CLI shows the same for a successful SSH login as it does for the failing webgui login.

Re: 9800-L-C AAA not working for HTTPS but works for SSHv2

Mark Elsen — Mon, 04 May 2026 17:19:05 GMT

- @Eric House Add this directive to the running configuration :
privilege exec all level 0 show version
And check if that can help

Re: 9800-L-C AAA not working for HTTPS but works for SSHv2

Eric House — Mon, 04 May 2026 17:20:23 GMT

Debug from switch returns:
May 1 17:09:49.990: %SEC_LOGIN-5-WEBLOGIN_SUCCESS: Login Success [user: USERNAME] [Source: xx.xx.xx.xx] at 12:09:49 CST Fri May 1 2026
May 1 17:09:49.991: %WEBSERVER-5-LOGIN_PASSED: Chassis 2 Login Successful from host xx.xx.xx.xx by user 'USERNAME' using crypto cipher 'TLS_AES_256_GCM_SHA384'

Re: 9800-L-C AAA not working for HTTPS but works for SSHv2

Eric House — Mon, 04 May 2026 17:21:53 GMT

No change with that addition.

Re: 9800-L-C AAA not working for HTTPS but works for SSHv2

Eric House — Mon, 04 May 2026 17:23:14 GMT

Looks the same as mine.

Re: 9800-L-C AAA not working for HTTPS but works for SSHv2

Mark Elsen — Mon, 04 May 2026 17:38:21 GMT

@Eric House Then I also advice to add : (ref mentioned by @Htonieto )
debug ip http authentication
debug tacacs
debug aaa authentication
debug aaa authorization

- Also use : logging trap debugging (to increase the logging level)
You may get some live action as a result of that ; by using the command
terminal monitor when connected with SSH.
Then try the GUI through https and follow up on the output; well output :
In programs such as PuTTY you can configure a session log file ; for later review !

Re: 9800-L-C AAA not working for HTTPS but works for SSHv2

aleabrahao — Mon, 04 May 2026 17:54:49 GMT

Have you checked the logs in ISE to see the reason for the failure?

I would start there in your place; the logs are much more intuitive than those in the WLC.

Re: 9800-L-C AAA not working for HTTPS but works for SSHv2

Eric House — Mon, 04 May 2026 18:02:27 GMT

The ISE logs show no failure, SSH and webgui logins show the same success logs.

Re: 9800-L-C AAA not working for HTTPS but works for SSHv2

Eric House — Mon, 04 May 2026 18:07:54 GMT

The additional debug and logging didn't show anything additional. The same login success log entries come up and nothing else. No indication of any ip http errors.

Re: 9800-L-C AAA not working for HTTPS but works for SSHv2

Eric House — Mon, 04 May 2026 18:15:20 GMT

I appreciate everyone's help with this, I stumbled upon the issue. The ip http client source-interface needs to match the ip tacacs source-interface. I had a mismatch and it was causing the error.