WLC no Authentication AAA TACACS+ ACS 5.5

[rnavarrete]

hello everybody, I have a issues with authentication WLC with ACS 5.5 on ACS log:

but en WLC no authentication USERS with AD

AAA Authentication Success for UserName: User Type: UNKNOWN:0

I don´t have issues with authentication router,swtich and asa. but WLC version 8 if i have problem authenticacion with tacacs+ can you help me please.

[Gagandeep Singh]

Hi,

WLC doesn't understand prIv level 15 like switch or router.

You need to create shell profile for role1=ALL without priv-15.

Attached screenshot for reference.

Regards

Gagan

PS: RATE IF IT HELPS!!!!

[Rafael Mauricio Navarrete Echegoyen]

Hello

Gagandeep Singh today create profile role1=ALL without priv-15. but with users de AD i can not access WLC

Attached screenshot

can you helpe me please

[Gagandeep Singh]

Please send the failed report from ACS. Are you trying to make it work with AD or internal users.

Regards

Gagan

[Rafael Mauricio Navarrete Echegoyen]

Hello I trying with Users AD. log ACS authenticacion is successful but I dont access WLC.

user AD:rnavarrete

passAD:Password1234

en WLC show:

401 Unauthorized

thank you

Rafael Navarrete

[Gagandeep Singh]

I want failed authentication detailed report for your WLC access session.

Also send the screenshot from

Access policy > Device administration  > authorization.

Need to check rule created...

[Rafael Mauricio Navarrete Echegoyen]

Hello I send you screenshot.

[Gagandeep Singh]

You haven't call WLCpermit shell profile in Authorization rule...

You need to call it then it will work.

Create new rule for WLC just not to impact other rules..

Regards

Gagan

PS: rate as correct if it helps!!!!

[Rafael Mauricio Navarrete Echegoyen]

hello, I have a WLCpermit shell profile but I dont know how create the rule without to impact other rules.(create profile role1=ALL without priv-15. but with users de AD )

can watch de sreenshot

can you help me ?

[Gagandeep Singh]

Create one more authorization rule with one condition that could be Device IP : WLC IP and result would be WLC shell profile and command set for full access.

Make this rule at the top for just WLC access....

Regards

Gagan

[Rafael Mauricio Navarrete Echegoyen]

Thank you very much i woking access wlc one more quiestion if possible create other rule to access WLC as user read-only can you help me

regards

Rafael Navarrete

[Gagandeep Singh]

You can use role1=MONITOR

Rate as correct for helpful threads!!!!

Regards

Gagan

[Rafael Mauricio Navarrete Echegoyen · Accepted solution]

thank you very much. now working WLC authentication with user READ WRITE AND READY ONLY.

best regards

Rafael Navarrete

[Gagandeep Singh]

Rate this thread as correct!!!!