Hello,
We are trying to correctly configure TACACS+ on our 9800 WLCs, so that we can manage CLI and GUI rights.
Device details :
- AAA Server : Cisco ISE 2.6.0.156
- WLC for testing : 9800-L 16.12.4a
Here's the story :
- When we use a Policy Set like one we use for Switches, it works well for CLI, no problem. But for GUI, there's absolutely no access control. An account that have read-only access through CLI will have Full read and write access through GUI.
- Then we try to see on ISE why and I saw something very strange : with a read and write account, I can see on ISE logs what is configured on 9800 through CLI, but through GUI, I can only see the "show" commands generated by GUI browsing, but absolutely no configuring commands are logged. It just hit our Shell Profile Priv 15, but absolutely no TACACS Command Set, which is a non-sense because we have a shell profile AND a TACACS command set attached to every Authorization Rule on ISE.
My questions :
- Do we have to create another custom Policy Set, Auth Profiles, Command Sets... that are not mentioned by Cisco ? If yes, what should be their content (like some Custom attributes) and how can we differentiate CLI traffic from GUI traffic on ISE ?
- Do I miss a part or should we reconsider our Policy/Auth Rules designs (I can tell you the details) so that we can make it work ?
- Is there a ongoing bug (didn't find any) for our versions ?
To anticipate one of your questions : I understand that these 9800 are working like switches (from TACACS point of view) because they are running IOS XE. So no problem we do not use again the same Policy Sets, Auth profiles, etc. as we use for AireOS WLC.
Every time we try to reach Cisco TAC, they directly close the case and share to us the official guide for configuring TACACS and RADIUS on 9800 : https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/214490-configure-radius-and-tacacs-for-gui-and.html
Of course we followed this guide many times and it just don't work as expected.
Thank you for your help !
