Catalyst 9800 External WebAuth AAA missing Radius Accounting

[Guilherme17849]

I'm facing an issue with external Radius Accounting packages. Running WLC 9800 Catalyst v17.2.1

The webauth prompts to the user (at my external server), got authenticated but after that, I don't receive any Radius Accounting package at my Freeradius. 

I've set up Radius server, Radius Server group and AAA under Method List tab, on AAA menu.

Is there any option which should be activated to get it working?

[Rafael E]

you need to map the accounting method on the policy profile. 

also, make sure you have: 

aaa accounting identity <name> start-stop group <RADIUS-group>

[Guilherme17849]

I've done with no success. Still not getting start-stop packages at my Freeradius.

Do you have any other hint? 

I'm concerning there's a misconfiguration or a bug at this version of 9800 Catalyst. According to previous versions that I had contact with, at WLAN Layer 3 settings there was an option to select the Accounting method. This option its not appearing to me, as we can see in the following screenshot.

 

[unsuspecting user]

Hello everyone,
I am also looking for the entry where I enter the Accounting Server in the SSID.
It is created under AAA Accounting.

In my opinion you should be able to select it from the Policy List under

Advanced - AAA Policy - Accounting List, but this is empty.

With the WISM it was quite simple in the AAA settings of the SSID with the drop down menu

Maybe I'm on the 9800 but also in a wrong menu.

Hence the question where is the assignment of SSID to the Accounting Server created?

Cisco IOS Software [Gibraltar], C9800 Software (C9800_IOSXE-K9), Version 16.12.3

[Scott Fella]

Don’t try to compare between the two as many things have changed. Take a look at the guide for 802.1x

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213919-configure-802-1x-authentication-on-catal.html

[unsuspecting user]

Hi, Scott,
i think i have found my problem, it seems to be a bug in the webUI
When I enter the created accounting list via CLI it seems to work with this guide.

see picture

Step 1
Device(config)# wireless profile policy default-policy-profile
Configures WLAN policy profile and enters wireless policy configuration mode.
Step 2
Device(config-wireless-policy)# shutdown
Disables the policy profile.
Step 3
Device(config-wireless-policy)# accounting-list user1-list
Sets the accounting list.
Step 4
Device(config-wireless-policy)# no shutdown
Enables the policy profile.

Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE Amsterdam 17.3.x
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-3/config-guide/b_wl_17_3_cg/m_config_model.html?bookSearch=true

Now I just have to find out the right accounting type for logging to the freeradius-accounting server for the guests in the wlan
i have put on "networks" for testing, but i am not sure if it is the right one.

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/214490-configure-radius-and-tacacs-for-gui-and.html

AAA Accounting Types

Named accounting method lists are specific to the indicated type of accounting.

• network --To create a method list to enable authorization for all network-related service requests (including SLIP, PPP, PPP NCPs, and ARAP protocols), use the network keyword. For example, to create a method list that provides accounting information for ARAP (network) sessions, use the arap keyword.
• exec --To create a method list that provides accounting records about user EXEC terminal sessions on the network access server, including username, date, start and stop times, use the exec keyword.
• commands --To create a method list that provides accounting information about specific, individual EXEC commands associated with a specific privilege level, use the commandskeyword.
• connection --To create a method list that provides accounting information about all outbound connections made from the network access server, use the connection keyword.

[Scott Fella]

There are a lot of documentation and blogs on aaa references that also show what others might configure or not. Typically I have seen accounting for Tacacs or vpn not much for wireless. You can have multiple in the method list also.