"test AAA group xxx username password new-code" always showed the "user rejected"

[yaoszhan]

I would like to test aaa connection in 9800-40 WLC, the software version of WLC is 16.12.03, I used the following command:

C9840-2#test aaa group zys-20 zys1 Test12345 new-code
User rejected

but it should be passed for authentication in ISE as follow:

I am not sure why it show user rejected, it should be User access. what wrong for this?

[Scott Fella]

I did try that also and got the same results and figured that it probably was not yet supported/functional since I didn’t see it referenced in the command reference guide.

[yaoszhan]

Thanks Scott for help validation again. It looks like ISE can receive the access-request message, but the WLC can’t handle access-accept message from ISE correctly.

[Scott Fella]

Yes you are correct, that is why I believe the feature isn’t available since it’s not in the reference guide. So until they fix/support that command, you will have to figure out another way to test.

[OCT]

Hi Scott

please see https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/214490-configure-radius-and-tacacs-for-gui-and.html#anc10 this how i got it working

[OCT]

Hi Yaoszhan

not sure what code you are running but i am able to test

ZA-WLC-9800-ENT-WLC#test aaa group tacacs+ octvwyk xxxx new-code
Sending password
User successfully authenticated

USER ATTRIBUTES

username 0 "octvwyk"
reply-message 0 "password: "

using the below reference

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/214490-configure-radius-and-tacacs-for-gui-and.html#anc10

regards

[Grendizer]

As a reference:

#test aaa group radius yourusername yourpassword new-code

#test aaa group radius dummy 1234 new-code

Or if you have multiple RADIUS Servers configured on the 9800 then you need to specify the correct one as below:

#test aaa group radius server name ISE24 dummy 1234 new-code

Or

#test aaa group radius server name ISE24 dummy 1234 legacy

legacy will give you understandable results better than new-code BUT the legacy option will not work with ISE 2.2 but will work with ISE 2.4 and after

While ISE24 is not actually the DNS Name of this server, it is the server name as it’s configured on the 9800 and called out under the radius group. dummy is the username, 1234 is the password

TACACS is the same but we can't test individual servers as RADIUS
#test aaa group tacacs+ dummy 1234 new-code
Or
#test aaa group tacacs+ dummy 1234 legacy