Configure AAA on WLC with ISE Radius

[DAVID]

I have added a WLC to ISE as a NAD device and configured ISE to only allow admin access to the WLC based on AD group but what is interesting is that even if I mistype my AD password I can still access the WLC. If I mistype my username but use correct password it denies me access to WLC which is what I would expect but allows me access to the WLC with correct username and wrong password.

WLC running 8.3.133

ISE 2.2.0.470 patch 4,5

What gives?

[Ben Walters]

What do your authentication and authorization rules look like for the WLC admin access?

It sounds like you might only be checking for username and allowing access based only on that.

[DAVID]

Would that be in the authentication policy under conditions?

[johnd2310]

Hi,

Check the authentication logs to see why the authentication is successful. You configuration on ISE might be missing something.The following doc should guide you in configuring authentication for WLC:

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/91631-uwn-tacacs-config.html

Thanks

John