C9800 HTTP authorization with AAA

[Fairytale16]

Hi,

I wonder if the community can advice on the problem below.

I'm configuring a stack of C9800 16.12.1

And I want to configure HTTP authorization via AAA.

First it should ask Radius, then go Local.

The Radius is not available now, but the WLC refuses to log in under local account.

I'm connecting on SP IP.

The configuration:

aaa group server radius RADIUS_SRV
server name RADIUS_1
server name RADIUS_2

!

username cisco privilege 15 password cisco

!

aaa new-model

aaa authentication login Local_Access group RADIUS_SRV local

!

radius server RADIUS_1
address ipv4 172.22.1.1 auth-port 1812 acct-port 1813
timeout 5
key smth
!
radius server RADIUS_2
address ipv4 172.22.1.2 auth-port 1812 acct-port 1813
timeout 5
key smth

i

ip http authentication aaa login-authentication Local_Access

Thank you in advance.

[Jurgens L · Accepted solution]

Did you follow this document below for setting up the WLC?

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/214490-configure-radius-and-tacacs-for-gui-and.html 

<<< Pls remember to rate all useful responses >>>

[Fairytale16]

Thank you, Jurgens.

I've missed that doco.
It works now.

The working configuration below:
aaa group server radius RADIUS_SRV
server name RADIUS_1
server name RADIUS_2
!
username cisco privilege 15 password cisco
enable secret cisco
!
aaa new-model
!
aaa authentication login Local_Access group RADIUS_SRV local
aaa authorization exec Local_Access group RADIUS_SRV local if-authenticated
!
!
radius server RADIUS_1
address ipv4 172.22.1.1 auth-port 1812 acct-port 1813
timeout 5
key smth
!
radius server RADIUS_2
address ipv4 172.22.1.2 auth-port 1812 acct-port 1813
timeout 5
key smth
!
ip http authentication aaa login-authentication Local_Access
ip http authentication aaa exec-authorization Local_Access
!

[Jurgens L]

Glad you came right, and thanks for sharing the working config!

[Scott Fella]

If you change the auth to local then radius, can you login with local credentials?