Issues with 9800-L CLI Access

[mumbles202]

Consoled into a 9800 today, created a new user, then logged into the GUI and did the Day 0 configuration.  Reconnected to the GUI and was able to do a good bit of the configuration from there; I also tried to ssh to the WLC and enter some configuration, but even though "enable" was listed when I entered "?" at the > prompt, when I try to enter it was a command I get a message "Error in Authentication".  I was able to use the CLI portion of the GUI to enter the configuration I needed to, but wanted to see if there was a reason for response and being unable to get into the CLI.  

[balaji.bandi]

From GUI you are able to use CLI, so post-show run here (check anything changed on the vty lines)

how about ssh ?

[mumbles202]

Looking at the exported configuration I think I see the issue.  During the Day 0 wizard I added a Radius server that I intended to use for 802.1x for 1 of the WLANs but I think the controller also might be using that for logins as well.  Shouldn't the controller fail-back to local authentication if the server isn't reachable or isn't responding (I put in a dummy password during the wizard).

[balaji.bandi]

yes it should if configured correctly AAA with radius and local- (since we are dark on the config - I am afraid to comment)

[mumbles202]

Totally understood.  Here's the aaa configuration:

aaa new-model
!
!
aaa group server radius RADIUS_SERVER_GROUP_DAY0
 server name RADIUS_SERVER_DAY0_1
!

aaa group server radius RAD_GRP_ACCT_POL
 server name RADIUS_SERVER_DAY0_1
!
aaa group server radius RAD_GRP_ACCT_POL_PROF
 server name RADIUS_SERVER_DAY0_1
!
aaa authentication login authentication_login_day0 group RADIUS_SERVER_GROUP_DAY0
aaa authentication dot1x authentication_dot1x_day0 group RADIUS_SERVER_GROUP_DAY0
aaa authentication dot1x DOT1X_AUTH_MYSSID group RADIUS_SERVER_GROUP_DAY0
aaa authorization network MAB_LOCAL_AUTH_Testing local 
aaa accounting identity ACCT_LIST_POL_ start-stop group RAD_GRP_ACCT_POL
aaa accounting identity ACCT_LIST_POL_PROF start-stop group RAD_GRP_ACCT_POL_PROF

aaa attribute list wlan_lobby_access
!
!
!
!
aaa server radius dynamic-author
!
aaa session-id common


radius server RADIUS_SERVER_DAY0_1
 address ipv4 192.168.1.10 auth-port 1812 acct-port 1813
 timeout 5
 retransmit 5

[mumbles202]

I was able to figure this out; was just missing an enable password.  Once I added that the command took and I was able to get into privileged mode from cli.

[balaji.bandi]

glad you able to resolve the issue, we mark as resolved now.

[Rich R]

You should probably have a read through https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/214490-configure-radius-and-tacacs-for-gui-and.html