Cisco C1111-p4 GUI access

[oren8891]

After following the directions on this setup link:

https://www.cisco.com/c/en/us/td/docs/routers/access/1100/software/configuration/xe-16-8/cisco_1100_series_swcfg_xe_16_8_x/cisco_1100_series_swcfg_xe_16_10_x_chapter_011001.html 

I still cannot access the GUI via my web browser.  I can ping the router just fine.  Here is my running config:

Current configuration : 1384 bytes
!
! Last configuration change at 20:14:33 UTC Fri Dec 15 2023
!
version 16.9
service timestamps debug datetime msec
service timestamps log datetime msec
platform qfp utilization monitor load 80
platform punt-keepalive disable-kernel-core
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
!
ip dhcp excluded-address 192.168.1.1 192.168.1.5
!
ip dhcp pool WEBUIPool
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
dns-server 192.168.1.1
!
!
!
login on-success log
!
!
!
!
!
!
!
subscriber templating
multilink bundle-name authenticated
!
!
!
!
!
license udi pid C1111-4P sn 
no license smart enable
!
diagnostic bootup level minimal
!
spanning-tree extend system-id
!
!
username webui privilege 
!
redundancy
mode none
!
!
vlan internal allocation policy ascending
!
!
!
!
!
!
interface GigabitEthernet0/0/0
no ip address
negotiation auto
!
interface GigabitEthernet0/0/1
no ip address
negotiation auto
!
interface GigabitEthernet0/1/0
!
interface GigabitEthernet0/1/1
!
interface GigabitEthernet0/1/2
!
interface GigabitEthernet0/1/3
!
interface Vlan1
ip address 192.168.1.1 255.255.255.0
ip nat inside
!
ip forward-protocol nd
no ip http server
ip http secure-server
!
!
!
!
!
!
control-plane
!
!
line con 0
transport input none
stopbits 1
line vty 0 4
login
!
!
!
!
!
!
end

Any help would be great!  Thank you!

[balaji.bandi]

have you tried different browser ? is your PC got DHCP IP address from router or manually configured ?

[Oren88911]

Yes I have tried Firefox, Chrome, and Edge without success. I set up my PC to have a dhcp address from the router and I can ping the router as well but still no success with being able to access the GUI.

[balaji.bandi]

After thinking and reviewing your config-  basically for https connection you need some ciphers - as per the config i do not see any ciphers configured

For testing - Enable http

ip http server

ip http authentication local

try http://ipaddressof router

still not working post below output :

#show ip http server status

#show ip http server connection

#show logging (show you if the connection from client intiated ?)

[oren8891]

Ok, so i tried those commands and I still dont have any luck.  Now Chrome, Firefox and Edge is giving me the "192.168.1.1 uses an unsupported protocol ERR_SSL_VERSION_OR_CIPHER_MISMATCH".  Here is the results of the show commands that you have asked for.

Router#show ip http server status
HTTP server status: Enabled
HTTP server port: 80
HTTP server active supplementary listener ports:
HTTP server authentication method: local
HTTP server auth-retry 0 time-window 0
HTTP server digest algorithm: md5
HTTP server access class: 0
HTTP server IPv4 access class: None
HTTP server IPv6 access class: None
HTTP server base path:
HTTP File Upload status: Disabled
HTTP server upload path:
HTTP server help root:
Maximum number of concurrent server connections allowed: 50
Maximum number of secondary server connections allowed: 50
Server idle time-out: 180 seconds
Server life time-out: 180 seconds
Server session idle time-out: 600 seconds
Maximum number of requests allowed on a connection: 25
Server linger time : 60 seconds
HTTP server active session modules: ALL
HTTP secure server capability: Present
HTTP secure server status: Enabled
HTTP secure server port: 443
HTTP secure server ciphersuite: 3des-ede-cbc-sha aes-128-cbc-sha
aes-256-cbc-sha dhe-aes-128-cbc-sha ecdhe-rsa-3des-ede-cbc-sha
rsa-aes-cbc-sha2 rsa-aes-gcm-sha2 dhe-aes-cbc-sha2 dhe-aes-gcm-sha2
ecdhe-rsa-aes-cbc-sha2 ecdhe-rsa-aes-gcm-sha2 ecdhe-ecdsa-aes-gcm-sha2
HTTP secure server TLS version: TLSv1.2 TLSv1.1
HTTP secure server client authentication: Disabled
HTTP secure server PIV authentication: Disabled
HTTP secure server trustpoint:
HTTP secure server peer validation trustpoint:
HTTP secure server ECDHE curve: secp256r1
HTTP secure server active session modules: ALL

Router#show ip http server connection

HTTP server current connections:
local-ipaddress:port remote-ipaddress:port in-bytes out-bytes
0.0.0.0:80 192.168.1.8:54854 489 765
0.0.0.0:80 192.168.1.8:54853 423 3984
0.0.0.0:80 192.168.1.8:54852 371 5897
0.0.0.0:80 192.168.1.8:54851 344 500

Router#show logging
Syslog logging: enabled (0 messages dropped, 2 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)

No Active Message Discriminator.

No Inactive Message Discriminator.

Console logging: level debugging, 90 messages logged, xml disabled,
filtering disabled
Monitor logging: level debugging, 0 messages logged, xml disabled,
filtering disabled
Buffer logging: level debugging, 90 messages logged, xml disabled,
filtering disabled
Exception Logging: size (4096 bytes)
Count and timestamp logging messages: disabled
Persistent logging: disabled

No active filter modules.

Trap logging: level informational, 94 message lines logged
Logging Source-Interface: VRF Name:

Log Buffer (4096 bytes):
O-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0/1, changed state to down
*Dec 15 20:04:51.809: %LINK-3-UPDOWN: Interface GigabitEthernet0/1/0, changed state to up
*Dec 15 20:04:52.810: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1/0, changed state to up
*Dec 15 20:04:52.816: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to up
*Dec 15 20:14:33.817: %SYS-6-TTY_EXPIRE_TIMER: (exec timer expired, tty 0 (0.0.0.0)), user
*Dec 15 20:14:33.817: %SYS-5-CONFIG_I: Configured from console by console
*Dec 15 20:18:32.881: %LINK-3-UPDOWN: Interface GigabitEthernet0/1/0, changed state to down
*Dec 15 20:18:32.883: %LINK-3-UPDOWN: Interface Vlan1, changed state to down
*Dec 15 20:18:33.883: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1/0, changed state to down
*Dec 15 20:18:33.884: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to down
*Dec 15 20:20:07.827: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to up
*Dec 15 20:20:09.806: %LINK-3-UPDOWN: Interface GigabitEthernet0/1/0, changed state to up
*Dec 15 20:20:09.827: %LINK-3-UPDOWN: Interface Vlan1, changed state to up
*Dec 15 20:20:10.807: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1/0, changed state to up
*Dec 15 20:23:37.808: %LINK-3-UPDOWN: Interface GigabitEthernet0/1/1, changed state to up
*Dec 15 20:23:38.811: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1/1, changed state to up
*Dec 15 20:34:21.998: %SYS-6-TTY_EXPIRE_TIMER: (exec timer expired, tty 0 (0.0.0.0)), user
*Dec 15 21:15:25.377: %SYS-6-TTY_EXPIRE_TIMER: (exec timer expired, tty 0 (0.0.0.0)), user
*Dec 15 22:27:46.875: %LINK-3-UPDOWN: Interface GigabitEthernet0/1/0, changed state to down
*Dec 15 22:27:47.877: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1/0, changed state to down
*Dec 15 22:27:53.812: %LINK-3-UPDOWN: Interface GigabitEthernet0/1/0, changed state to up
*Dec 15 22:27:54.814: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1/0, changed state to up
*Dec 15 23:01:06.880: %LINK-3-UPDOWN: Interface GigabitEthernet0/1/1, changed state to down
*Dec 15 23:01:07.881: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1/1, changed state to down
*Dec 16 10:13:19.267: %LINK-3-UPDOWN: Interface GigabitEthernet0/1/0, changed state to down
*Dec 16 10:13:19.269: %LINK-3-UPDOWN: Interface Vlan1, changed state to down
*Dec 16 10:13:22.188: %LINK-3-UPDOWN: Interface GigabitEthernet0/1/0, changed state to up
*Dec 16 10:13:22.192: %LINK-3-UPDOWN: Interface Vlan1, changed state to up
*Dec 18 14:45:34.808: %LINK-3-UPDOWN: Interface GigabitEthernet0/1/0, changed state to down
*Dec 18 14:45:34.816: %LINK-3-UPDOWN: Interface Vlan1, changed state to down
*Dec 18 14:45:37.732: %LINK-3-UPDOWN: Interface GigabitEthernet0/1/0, changed state to up
*Dec 18 14:45:37.749: %LINK-3-UPDOWN: Interface Vlan1, changed state to up
*Dec 18 21:57:15.657: %SYS-5-CONFIG_I: Configured from console by console
*Dec 18 21:57:24.285: %SYS-2-PRIVCFG_ENCRYPT: Successfully encrypted private config file
*Dec 18 21:57:29.936: %LINK-3-UPDOWN: Interface GigabitEthernet0/1/0, changed state to down
*Dec 18 21:57:29.938: %LINK-3-UPDOWN: Interface Vlan1, changed state to down
*Dec 18 21:57:32.861: %LINK-3-UPDOWN: Interface GigabitEthernet0/1/0, changed state to up
*Dec 18 21:57:32.883: %LINK-3-UPDOWN: Interface Vlan1, changed state to up
*Dec 18 22:04:11.928: %LINK-3-UPDOWN: Interface GigabitEthernet0/1/0, changed state to down
*Dec 18 22:04:11.932: %LINK-3-UPDOWN: Interface Vlan1, changed state to down
*Dec 18 22:04:14.859: %LINK-3-UPDOWN: Interface GigabitEthernet0/1/0, changed state to up
*Dec 18 22:04:14.869: %LINK-3-UPDOWN: Interface Vlan1, changed state to up
*Dec 18 22:04:18.926: %LINK-3-UPDOWN: Interface GigabitEthernet0/1/1, changed state to up
*Dec 18 22:04:19.924: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1/1, changed state to up
*Dec 18 22:17:46.737: %SYS-6-TTY_EXPIRE_TIMER: (exec timer expired, tty 0 (0.0.0.0)), user

[oren8891]

I also tried lowering the TLS version as well with no success

[oren8891 · Accepted solution]

I found a post that worked!

 conf t
no crypto pki trustpoint TP-Self-Signed-xxxxxxxxxx
no ip http server
no ip http secure-server
ip http server
ip http secure-server
ip http authentication

https://community.cisco.com/t5/switching/catalyst-9200l-cipher-mismatch/td-p/4423920 

Thank you balaji for all of your help!