topic Re: Login to WLC Using Https in Wireless

Login to WLC Using Https

jmorton1 — Wed, 10 Jun 2026 04:35:18 GMT

We have already implemented TACACS+ in order to log into the CLI of our WLC using our domain admin creds. We are looking to do the same thing for web ui of the wlc. We already tried going under AAA Advanced and setting authentication and authorization to the same AAA group as SSH, along with creating an authorization policy in ISE that has the WLC ALL TACACS+ Profile. However, the authorization profile is actually blocking authorization for SSH access and when we do log into web ui, it is coming up with read-only access. What do we need to be doing differently?

Re: Login to WLC Using Https

Mark Elsen — Wed, 10 Jun 2026 05:49:00 GMT

- @jmorton1 Have a look at : https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/214490-configure-radius-and-tacacs-for-gui-and.html
For troubleshooting : https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/214490-configure-radius-and-tacacs-for-gui-and.html#toc-hId--898159109

Re: Login to WLC Using Https

balaji.bandi — Wed, 10 Jun 2026 08:48:07 GMT

what version WLC IOS XE CODE, and is this AAA is ISE

check below guide and post what errors you getting on ISE to understand the issue.

https://www.wiresandwi.fi/blog/cisco-wlc-9800-aaa-tacacs-device-administration-configuration-cli

Re: Login to WLC Using Https

jmorton1 — Fri, 12 Jun 2026 18:22:05 GMT

There are no errors related to this. The WLC is on IOS XE 26.1.1 and ISE is on 3.5 Patch 3

Re: Login to WLC Using Https

aleabrahao — Fri, 12 Jun 2026 18:44:51 GMT

You just need to configure your device admin authorization policy similar to this.

Remember to set the tacacs profile with privilege 15.

After that, you just need to define the auth list in the WLC's HTTPS management configuration.

Take a look at the documentation,

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/214490-configure-radius-and-tacacs-for-gui-and.html

Re: Login to WLC Using Https

jmorton1 — Fri, 12 Jun 2026 19:46:38 GMT

I have been going through this guide and I seem to have things configured the way it suggests, but when I sign into https, it still only gives me WLC Monitor view. For the authorization, it is hitting the Device Admin Policy that allows Privilege 15 for SSH for members of a certain AD group. I tried setting up a separate policy in device admin with a shell profile with WLC ALL, but devices are not hitting that policy when trying to sign in with https. If I move that policy to the top of the list, then it blocks authorization to SSH.

Re: Login to WLC Using Https

aleabrahao — Fri, 12 Jun 2026 19:52:03 GMT

You're probably forgetting something. I suggest you review everything and check the TACACS logs in ISE; you'll usually find the cause of the problem there.

Good luck.

Re: Login to WLC Using Https

aleabrahao — Fri, 12 Jun 2026 19:58:33 GMT

Another detail: on the 9800 you don't need a separate policy for SSH and web access; the same policy serves for both. It's very likely you're encountering a different policy.

If the details of your configuration and logs aren't clear, there's not much to say.

Re: Login to WLC Using Https

jmorton1 — Tue, 16 Jun 2026 02:30:24 GMT

I figured it out, and it was due to me failing to read the first few lines of the document concerning read-only access.
The existing SSH Admin Access policy we had in place for the CLI had priv 1 as default and priv 15 as the maximum in order to force us to have to enter an enable password. However, this was causing the web ui to load with priv 1 and not 15. Once I changed the default to privilege level 15 then I was able to log into the web ui with full admin.

Thanks everyone!