Webui 9200L

[sphillips]

---

I having an issue with accessing the webui for the catalyst 9200L. My previous vendor configured my switch. I can access the switch through putty but have limited education with CLI and would prefer to use the webui. I can access the webui Cisco credential screen by using the IP of the switch in HTTP but the only account I'm aware of that works with CLI doesn't work with webui. I tried default credentials for webui but it doesn't work either since the switch is already configured. Do I need to set up the webui and/or create an account in the CLI before being allowed to use this webui? I'm assuming the vendor set up all the major settings in CLI and maybe skipped the day0 wizard webui setup? Please be aware the switch has devices on it and it can't be rebooted so I can't run any commands that will affect the performance of any devices. Thank you!

[pieterh]

yes, an account must exist to be allowed to access the web-ui
this can be a local account or an account accessible via radius

there are several settings to check
- is the web-ui enabled at all?
   "show running-config | include http" -> check and if not enabled -> enable
   "ip http server"
   "ip http secure-server"
- are there any access-lists that limit web-access ?
   "show access lists"
- does your browser accept the security settings and the certificate used by the switch?
   (this may not be so obvious to determine)
   if not either match security-settings on switch with that from  browser, or upload a public validated certificate

[sphillips]

Thank you Pieterh for reach out to assist me. According to my current vendor, he's saying these switches are not set up for browser access by default and were not set up by the previous vendor. He said we can enable it in CLI, but he isn't available to assist me at the moment so if you can be any help I would greatly appreciate it. I do see some of the commands in the CLI so maybe he's assuming it wasn't enable. I'm not sure.

I ran the running-config and see the following...

ip http server

ip http authentication local

ip http secure-server 

I ran show access-lists and see the following...

Extended IP access list IP-Adm-V4-Int-ACL-global
10 permit tcp any any eq www
20 permit tcp any any eq 443
Extended IP access list implicit_deny
10 deny ip any any
Extended IP access list implicit_permit
10 permit ip any any
Extended IP access list preauth_v4
10 permit udp any any eq domain
20 permit tcp any any eq domain
30 permit udp any eq bootps any
40 permit udp any any eq bootpc
50 permit udp any eq bootpc any
60 deny ip any any
IPv6 access list implicit_deny_v6
deny ipv6 any any sequence 10
IPv6 access list implicit_permit_v6
permit ipv6 any any sequence 10
IPv6 access list preauth_v6
permit udp any any eq domain sequence 10
permit tcp any any eq domain sequence 20
permit icmp any any nd-ns sequence 30
permit icmp any any nd-na sequence 40
permit icmp any any router-solicitation sequence 50
permit icmp any any router-advertisement sequence 60
permit icmp any any redirect sequence 70
permit udp any eq 547 any eq 546 sequence 80
permit udp any eq 546 any eq 547 sequence 90
deny ipv6 any any sequence 100

I'm assuming my browser accepts the security settings and certificate because it takes me to the Cisco credential log in screen when I put the IP of my switch in my browser but I can't log in. If the above settings look correct, maybe they didn't create a user for this or if they did, I'm not aware of the information. Thank you!! 

[pieterh]

ip http server

ip http secure-server

-> thats OK http access is enabled

ip http authentication local

-> only local users can login into the webserver

=> issue a "show running-config | include user" to see what local users exist

check if you know the password for any of these users (don't post the passwords here)

[sphillips]

Yes, I will only need to local access. I'm not sure if there's users or if I'm doing something wrong? The command "show running-config | include user" doesn't do anything. It doesn't tell me the command is incorrect either. After typing the command and hitting enter, the command prompt drops down to the next line and is waiting for another command. I ran show users and this is the following...

Line                        User                  Host                     Idle                  Location

2 vty 0                                             Idle                    00:00:00           192.168.xxx.xxx

Interface                User                  Mode                  Idle                 Peer address 

[pieterh]

"show users" is not the right command, this is to display the active user sessions, not the available local accounts.

>>> the command prompt drops down to the next line and is waiting for another command <<<
this indicates there are no local users defined (there is no line in the configuration where a local-account is defined),

because of "ip http authentication local" you cannot login into the web-interface

you probably need to change this to "ip http authentication group radius "

post the full config or at least "show running-config | include radius" and "show running-config | include aaa"
to determine if and how radius is configured

[sphillips]

The "show running-config | include radius" does the same thing with the command prompt and dropped down waiting for the next command. 

The "show running-config | include aaa" says no aaa new-model. 

[sphillips · Accepted solution]

I simply needed to create a user. 

En

Config t

Username xxxx privilege 15 password xxxxx

End wri mem