C9800 unable to SSH via TACACS on Service Port

[stephendrkw]

Hi all,

I have setup AAA on my new C9800 Anchor WLC replacement for an old WLC 5508. Mobility tunnels are up with other Anchor and Foreign 5508's running IRCM image. Problem I have now for some reason TACACS is not working properly to Manage WLC via out of band Service Port. I would like to use TACACS Mgmt via Service Port like my 5508's.

For some reason I can login to the console port successfully using my TACACS username/password but not SSH (haven't setup http yet as there command to enable tacacs for HTTPS access)

Enter my tacacs username via SSH..........

WLC console logg -  %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user:username]

C9800>en
% Error in authentication.

Below are my commands, you can see I had to add ip tacacs route to force via Service Port, inbound and outbound are working through my Firewall Cluster once I added specific route.

I did not add "aaa authorization commands" - log message saying not supported in future XE releases hidden command

aaa new-model
!
aaa group server tacacs+ TAC_EXT
server name TACACS_SVR_AUTH_ACT_ATHR_2
server name TACACS_SVR_AUTH_ACT_ATHR_3
ip vrf forwarding Mgmt-intf
!
aaa authentication login default group TAC_EXT local
aaa authorization network default group TAC_EXT local
!
ip tacacs source-interface GigabitEthernet0 vrf Mgmt-intf

ip route vrf Mgmt-intf 10.x.x.x(TACACS.SERVERS) 255.255.255.255 GigabitEthernet0 10.x.x.x (return packets on Firewall Cluster logs for UDP49 from WLC to TACACS Servers started working via SP after I added this route before this route return packets were denied)
!
ip ssh rsa keypair-name SSH-KEY
ip ssh version 2
!
tacacs server TACACS_SVR_AUTH_ACT_ATHR_2
address ipv4 10.x.x.x
key 7 *********
timeout 5
tacacs server TACACS_SVR_AUTH_ACT_ATHR_3
address ipv4 10.x.x.x
key 7 *********
timeout 5

[Arshad Safrulla]

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/214490-configure-radius-and-tacacs-for-gui-and.html#:~:text=look%20like%20this%3A-,Then,-create%20a%20similar

 shell:priv-lvl=15 - For Admins who can change config

 shell:priv-lvl=1

 shell:priv-lvl=0

[Rich R · Accepted solution]

9800 does not support role-based authorisation.

Refer to https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/214490-configure-radius-and-tacacs-for-gui-and.html

Also see @Rasika Nayanajith guide at https://mrncciew.com/2022/05/27/9800-tacacs/

[stephendrkw]

Correct! As I found out yesterday, the C9800's do not support role-based authorisation. Role-based authorisation was removed from the ISE for this particular device. As soon as they applied, I could login via SSH, console, HTTPS with my TACACS account.

Thanks everyone for your comments and suggestions.

[Rich R]

ps there are 2 bugs open for role based TACACS auth on 9800 - both are Sev 6 = Feature Enhancement Request (even though CSCvs94910 looks 100% like a bug).  That means Cisco will only work on them if enough big customers pressure them to do it but so far seems to be a very low priority:
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvs94910
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvu91616