Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

PDF

Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

Security utilities configuration options

Updated: April 10, 2026

Want to summarize with AI?

Log in

Introduces security configuration utilities and provides instructions for configuring multiple RADIUS servers with procedures to verify AAA and RADIUS server configurations.

You can set up the RADIUS server using this simplified method:

wireless-default radius server ip key secret

  • Configures AAA authorization for network services, including authentication for web authentication and Dot1x.

  • Enables local authentication with default authorization.

  • Applies the default redirect ACL for Central Web Authentication (CWA).

  • Creates a global parameter map with a virtual IP and enables captive bypass portal.

  • Configures all default AAA settings required when configuring a RADIUS server.

  • Sets method-list configuration and enables RADIUS accounting by default.

  • Disables RADIUS aggressive failovers by default and sets the RADIUS request timeout to five seconds.

  • Implements a default access control list (ACL) for CWA URL redirect.

aaa new-model
                aaa authentication webauth default group radius
                aaa authentication dot1x default group radius
                aaa authorization network default group radius
                aaa accounting identity default start-stop group radius
                !
                aaa server radius dynamic-author
                client <IP> server-key cisco123
                !
                radius server RAD_SRV_DEF_<IP>
                description Configured by wireless-default
                address ipv4 <IP> auth-port 1812 acct-port 1813
                key <key>
                !
                aaa local authentication default authorization default
                aaa session-id common
                !
                ip access-list extended CISCO-CWA-URL-REDIRECT-ACL-DEFAULT
                remark “ CWA ACL to be referenced from ISE "
                deny udp any any eq domain
                deny tcp any any eq domain
                deny udp any eq bootps any
                deny udp any any eq bootpc
                deny udp any eq bootpc any
                deny ip any host <IP>
                permit tcp any any eq www
                !
                parameter-map type webauth global
                captive-bypass-portal
                virtual-ip ipv4 192.0.2.1
                virtual-ip ipv6 2001:DB8::1
                !
                wireless profile policy default-policy-profile
                aaa-override
                local-http-profiling
                local-dhcp-profiling
                accounting

Key benefits

  • Simplifies deployment of RADIUS server configuration for wireless controllers.

  • Eliminates the need for step-by-step manual configuration across multiple CLI commands.

  • Ensures consistent and secure default settings for AAA and authentication services.

Configure multiple RADIUS servers

To configure multiple RADIUS servers for authentication in a network.

Before you begin

Ensure you have the necessary IP addresses and shared secrets for the RADIUS servers.

Procedure

1.

Enter global configuration mode

Example:

Device# configure terminal
2.

Configure a RADIUS server

Example:

Device(config)# wireless-default radius server ip key secret

Example:

Device(config)# wireless-default radius server 192.2.58.90 key cisco123

You can configure up to ten RADIUS servers.
3.

Return to privileged EXEC mode

Example:

Device(config)# end

Alternatively, you can also press Ctrl-Z to exit global configuration mode.
Multiple RADIUS servers are now configured and ready for use in the network.

Verify AAA and Radius server configurations

To view details of AAA server, use these command:

Device# show run aaa
!
aaa new-model
aaa authentication webauth default group radius
aaa authentication dot1x default group radius
aaa authorization network default group radius
aaa accounting Identity default start-stop group radius
!
aaa server radius dynamic-author
 client 192.0.2.10 server-key cisco123
!
radius server RAD_SRV_DEF_192.0.2.10
 description Configured by wireless-default
 address ipv4 192.0.2.10 auth-port 1812 acct-port 1813
 key cisco123
!
aaa local authentication default authorization default
aaa session-id common
!
!
ip access-list extended CISCO-CWA-URL-REDIRECT-ACL-DEFAULT
remark “ CWA ACL to be referenced from ISE "
deny udp any any eq domain
deny tcp any any eq domain
deny udp any eq bootps any
deny udp any any eq bootpc
deny udp any eq bootpc any
deny ip any host 192.0.2.10
permit tcp any any eq www
!
parameter-map type webauth global
  captive-bypass-portal
  virtual-ip ipv4 192.0.2.1
  virtual-ip ipv6 2001:DB8::1
!
wireless profile policy default-policy-profile
   aaa-override
   local-http-profiling
   local-dhcp-profiling
   accounting
Note

The show run aaa output may change when new commands are added to this utility.