WLC 9800 Authentication group confussion

[MAHI_VYAS]

Hi Team,

I have WLC 9800 and we have radius and ldap servers configured, I have authentication method for one of group is configured as Local and no radius/ldap group called in that method list.

Highlight group is called in one of my Wlan and i see users are also getting authenticated, iam not able to figure out how users are getting authenticated.

Can anyone explain about this.

Thanks in advance for all support.

[MHM Cisco World]

I need to see L2 secuirty and L3 secuirty of this wlan

MHM

[Scott Fella]

From what I see in your 2nd picture, you are using local EAP, that means you are not using a radius server but have specified local accounts/ldap on the controller and referencing that in your wlan aaa.  Under your 1st pic, you should look at the Server/Groups and look at the LDAP. However, your configuration doesn't not use any Groups, that to me means local account on the controller.
Your default and ldapdot1x-tac is the same and if shouldn't matter which one you choose.  Now this you can validate by creating a test SSID and using the default first and then the ladpdot1x-tac to see if both authenticates the user.

What I think is that someone created the ldapdot1x-tac and couldn't get it to work.  What your AAA method list shows, for the last two items is the same authentication, but just a different name.  The name doesn't matter in your case because its doing the exact same thing.

[MAHI_VYAS]

Hi @Scott Fella ,

In this case how my users are getting authenticated, i do not see any local users on my WLC.

Can you please help in that.

[Scott Fella]

I think you need to look at the overall clients and see how many are connecting to an SSID using whatever profile.  Then also look if you have any local users configured and if you have any ldap servers configured.  The ldap is not going to be used in your configuration.  

I don't know how many SSID's you have nor what the SSID's are configured for, but in the monitoring tab in the GUI, you can look at the clients and also use the filter on SSID.

[Scott Fella]

Maybe you are not using that AAA method so its not being used.  I don't know unless you provide more details, like screenshots or text output.

** Update **

I do see you have it configured on one of the SSID's, so you need to see if anyone is actually connecting to that SSID or not.  Again, how you have it configured, it is local auth, so either local user or maybe an admin account. Identify clients using it and why not you try connecting and creating yourself a local user account for testing.  That way you can see it work.

[Rich R]

If you want to know how any particular user is authenticated run a Radioactive Trace on the client MAC address.
You can use Debug Analyzer (link below) to decode the RA trace.
Use Config Analyzer (link below) to check your WLC config.