Privilege level not showing properly on 9800-CL

[MPribadi]

Hi,

I have issue in implementing privilege level command for non-admin user on our C9800-CL. We have 3 types of users:

- Super-admin level: it is level 15

- Admin level: it is level 7 for L2 support to do some users deauthentication, adding some commands, etc

- RO level: for monitoring purpose

I have issue when assigning this priv level command for admin level (level 7). CLI commands can works perfectly, but when L1 support want to access the webGUI, it doesn't show the graph anymore. But when I remove privilege level command, then they can see the graph again.

Before I implement the priv level command, the page for test_ro user (L1 user) shows as below:

but after i put the commands:

username test_ro secret 9 xxxxxxx
username test_rw privilege 7 secret 9 xxxxxxxx
privilege configure level 7 user-name
privilege exec level 7 configure terminal
privilege exec level 7 configure
privilege exec level 7 show aaa local guest_user
privilege exec level 7 show aaa local
privilege exec level 7 show aaa
privilege exec level 7 show
privilege exec level 7 wireless client mac-address
privilege exec level 7 wireless client username
privilege exec level 7 wireless client
privilege exec level 7 wireless
privilege exec level 7 wireless deauthenticate
privilege user-name level 7 wlan-profile-name

then the page for test_ro shows as follow:

the overview page just keep loading and i cannot do anything. If I click one of the "box" (example here, i clicked access points), then it shows:

but no issue with Super-Admin (level 15) or admin (level 7) account:

any help will be appreciated.

Thanks,

Pribadi

[marce1000]

  - What software version is the C9800-CL running ?
  - Have a checkup of it's configuration using the CLI command show tech wireless ; and feed the output into :
                                                                                              Wireless Config Analyzer

 M.

[MPribadi]

Hi @marce1000,

- it is running 17.9.5

- did that and found nothing related with setting up the privilege level config. find attached the result.

regards,

pribadi

[marce1000]

 - For the time being I can only give a general answer to go for the advisory release : 17.9.4a     
                                                                                                                     and check if that can help , 

 M.

[MPribadi]

Hi @marce1000,

tested it and same issue there. 17.9.4a also has an issue in LobbyAdmin (ref: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwh37783). This is the reason I open a discussion here.

Regards,

Pribadi

[MHM Cisco World]

This from Cisco doc.

When TACACS+ or RADIUS is used for 9800 WebUI authentication, these restrictions exist:

• Users with privilege level 0 exist but have no access to the GUI

• Users with privilege levels 1-14 can only view the Monitor tab (this is equivalent to the privilege level of a read-only locally authenticated user)

• Users with privilege level 15 have full access

• Users with privilege level 15 and a command set that allows specific commands only are not supported. The user can still be able to execute configuration changes through the WebUI

I.e. you can not make each user get it gui according to privilege' there are fix modes

MHM

[MPribadi]

Hi @MHM Cisco World,

Read that. But I'm not using TACACS+ or RADIUS for the authentication. I'm using local authentication.

Pribadi.

[MHM Cisco World]

Friend it same' 

The privilege either return from aaa server after success auth or the wlc use it local database to authc and authz the privilege of local user.

MHM

[Rich R]

@MHM Cisco World is correct - 9800 GUI does not support multiple priv levels - only 0, 1 and 15 as per that guide.

There's an enhancement request for full RBAC https://bst.cisco.com/bugsearch/bug/CSCwd66510 but I've not heard about any intention to implement it yet so for now the workaround, as per the bug details, is "Use CLI instead of GUI" <smile>