cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
805
Views
5
Helpful
1
Replies

How to setup AAA to define GUI role in cisco wireless controller 9800

PradeepSingh
Beginner
Beginner

Hi,

 

We are migrating from AiroS controllers to 9800 platform.

In AirOS we used to give two types of access to Admin users using role supplied from ISE.

 

1.FULL

2. MONITOR 

 

Now we want similar thing in 9800, which is IOS XE. In our environment we have a lot of OS XE devices and we have configured with command authorization in AAA configuration to customize admin access. Now if we replicate the same thing in 9800 configuration CLI is working fine. But in case of GUI access it is throwing a bunch of requests( sometime 20 show commands ) for command authorization to AAA,  the moment we try to open or browse any page using HTTPS access. Page is loading very slow due to that.

Just wondering if anyone set this up already as this seems a very common requirement of customized admin access and command authorization from AAA basis user roles.

 

Here is the configuration for command authorization.

 

aaa authorization config-commands

aaa authorization commands 1 default group ISE local
aaa authorization commands 15 default group ISE local

 

Thanks in advance.

1 Reply 1

Rich R
VIP Advisor VIP Advisor
VIP Advisor

Our SE queried with wireless network business unit and told us command authorization for GUI is currently not supported.

He also added that it may be difficult to implement because the GUI uses the API to read and write config to the WLC so it's difficult to map API calls to individual commands so remains to be seen if/when they fix it and how they choose to do it.

 

There are 2 "feature enhancement" bugs filed for this (ignore the fact that one of them says only 2600 - it's actually for 9800 lol)

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvs94910

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvu91616

 

___________________________________________
TAC recommended codes for AireOS WLC's
Best Practices for AireOS WLC's
TAC recommended codes for 9800 WLC's
Best Practices for 9800 WLC's
Cisco Wireless compatibility matrix
Field Notice: FN-72424 Later Versions of WiFi 6 APs Fail to Join WLC - Software Upgrade Recommended
WARNING - see CSCwd37092 Throughput degraded after upgrading to code 8.10.181.0/17.3.6 - 2800/3800/4800 series
- The fix for CSCwd37092 is now released in 8.10.183.0 and
- For IOS-XE 17.3.6 select controller model, go to IOS XE Software AP Service Pack, select CSCwd40096 17.3.6 APSP2
Field Notice: FN-63942 Lightweight APs and WLCs Fail to Create CAPWAP Connections Due to Certificate
                      Expiration - Software Upgrade Recommended
Field Notice: FN-72524 - During Software Upgrade/Downgrade IOS APs Might Remain in Downloading State
                     After 4 Dec 2022 Due to Certificate Expiration - Fixed in 8.10.183.0 and 17.3.6 APSP5 (APSP_CSCwd83653)
                     Also fixed in 8.5.182.7 (8.5 mainline) and 8.5.182.105 (8.5 IRCM) if you can't upgrade to 8.10
                     Note that 8.10.181.0 and 8.10.182.0 have been deferred (withdrawn) and are effectively unsupported by Cisco
___________________________________________
Richard R
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers