logon to wlc for authentication and authorization

[Leftz]

Hi c9800 wlc is using Radius for authentication and authorization , now we added TACACS to wlc and ise. The question is how to confirm my access to wlc is through tacacs? Thank you

[Flavio Miranda]

Hi

  You can check that by looking into the configuration of the WLC.

Go to SECURITY> Priority Order> Management User

You can see a small window with "Order used for Authentication" , there might ne TACACS+ in the first line.

[Leftz]

Thank you Flavio for your reply. do you me mean the below "Configuration" . I cannot see "Priority Order"

[Flavio Miranda]

oh sorry, you said WLC 9800 and I though AIROS WLC.

For 9800 you can check on the AAA, TACACS+ / AAA Method List, the default option must be reffering to your TACACS server.

Type login and type dot1x. The first is access to the WLC and second is for Wireless users

[Leftz]

@Flavio Miranda Can we confirm this via something like logs? even if its with ise

[Flavio Miranda]

Sure, if you have access to the ISE, you can probably see the authentication sessions on the live logs. 

On the WLC via CLI you are going to see a log like this one

UTC: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: xxxx ] [Source: xxxxx  [localport: 22] at xxxxxx

Via CLI you can also the this:

show run | i aaa

aaa authentication login default group "tacacs group"  local

which means first TACACS then local

[vmhoang2]

hi

In AAA authentication, I selected login local Group radius. in AAA authorization, I selected exec local group radius. I have a question, if I have authenticated the above user based on the Radius response and how to authorize the user using only NPS.

[Rich R · Accepted solution]

show tacacs

show aaa servers

[Leftz]

Thanks! this looks like to work. The command can show something useful.

I tried to find a command to show radius like show tacacs, but I could not find it. Is there a command to show radius? this way we can know transferring from Radius to tacacs exactly

and not sure if there is a command to clear count

vWLC01#sh tacacs

Tacacs+ Server - public :
Server name: ISE-Lab
Server address: 10.1.2.2
Server port: 49
Socket opens: 5
Socket closes: 5
Socket aborts: 0
Socket errors: 0
Socket Timeouts: 0
Failed Connect Attempts: 0
Total Packets Sent: 5
Total Packets Recv: 0
Server Status: Alive
Continous Authc fail count: 0
Continous Authz fail count: 0

[Rich R]

I already gave you both commands above!