ACS 5.5 and WLC 5508 Management Access via RADIUS Auth

[ALIAOF_]

We are deploying ACS5.5 and after some work I have been able get this to work but got another issue. 

Currently ACS uses AD authentication

Under Access Policies and Service Selection Rules I crated a rule for the WLC and moved it towards the top and was able to log in as the management user.  However this allows any user to log in as a management user.

If I move the rule down then I can log in as a read only user as I'm getting the default policy.  And other users can also log in as read only users.

Any pointers on how to fix this?

[nspasov]

Hello Mohammad, can you post a screen shot of your Access Policies. 

Thank you for rating helpful posts!

[ALIAOF_]

Attached is the screen shot.  If I move the WLC-Permit policy towards the top I can log into the WLC via RADIUS auth and can make changes but so can all the other domain users.

[nspasov]

Sorry for the delayed reply Mohammad but work has been keeping me busy. Can you also provide a screenshot of the details of your access policy rules. I want to see the actual details. 

Thank you for rating helpful posts!

[ALIAOF_]

No problem same here :), thank you for your help.  So instead of RADIUS I am trying to see if I can keep the management access separate and utilize TACACS instead however that isn't working either.  Let me know if these screen shots are ok.

[nspasov]

Hi Muhammad. I think your rule #2 is getting hit before your WLC rule. Both, rule-1 and rule-2 are very generic and are only set to match against Radius or Tacacs. As a result, those rules will always be hit first since they are very generic. That is probably why everything works when you put the WLC-Permit rule on the top.

It is recommended that you put your more specific rules towards the top and the less specific rule at the bottom. Hence, the reason the default rule is at the bottom (If nothing else matches then do this)

I hope this helps!

Thank you for rating helpful posts!