Cisco Catalyst IW9167E Heavy Duty Access Point Configuration Guide, Release 26.1.x

PDF

Cisco Catalyst IW9167E Heavy Duty Access Point Configuration Guide, Release 26.1.x

AAA user authentications

Updated: April 10, 2026

Want to summarize with AI?

Log in

Learn how to configure an external AAA server and how to enable or disable RADIUS authentication for login users.

AAA user authentication is a network management mechanism that:

  • controls access to network resources through user authentication,

  • assigns differentiated privilege levels to users, and

  • manages usernames and passwords centrally on the AAA server.

From Release 17.15.1, AAA-based user management and authentication are supported on IW9167EH WGB.

The AAA server assigns privilege levels (0–15) via Authorization-Reply messages. Only levels 1 (view user) and 15 (management user) are supported. Levels 2–14 are reserved and must not be assigned.

If a user is added without a privilege level, WGB will assign the lowest privilege level to that user.

Features of AAA-based user management and authentication

AAA-based user management and authentication includes these features:

  • Provides multiple-user support

  • Stores usernames and passwords on the AAA server

  • Authenticates users with AAA

  • Supports differentiated user privileges

  • Restricts CLI access based on user privileges

Note

Similar to a Cisco Router or Switch, the Workgroup Bridge (WGB) can also create and store usernames and passwords locally.

Configure AAA Server

Before you begin

  • You can add a secondary AAA server (RADIUS or TACACS+) before adding a primary AAA server. Once the primary AAA server is added, clients connect to the primary AAA server.

  • When both primary and secondary RADIUS servers are configured, the WGB attempts to connect with the primary RADIUS server three times before switching to the secondary RADIUS server.

  • For the TACACS+ server, the connection attempt is done only once with the primary TACACS+ server. If the primary TACACS+ server fails to respond, the secondary TACACS+ server is used.

Note

The WGB AAA RADIUS server configuration command is officially supported starting from the 17.15.1 release.

If you downgrade the image from release 17.15.1 or later to 17.14.1 or earlier, or upgrade from 17.14.1 or earlier to 17.15.1 or later, the configured RADIUS server port resets to zero. Reconfigure the RADIUS server port.

Procedure

Add or remove a AAA server (RADIUS or TACACS+).

Option Description
Configure a AAA server Use the config { radius | tacplus} authentication { primary | secondary} add { ipv4 | ipv6} ip-address port port-number secret secret-string command.
Device# configure radius authentication primary add ipv4 10.10.10.5 port 100 secret radiusSecret123
Note

Do not use unsupported characters in secret-string parameters. These characters include the vertical bar (|), semicolon (;), dollar sign ($), less than (<), greater than (>), ampersand (&), caret (^), grave accent (`), backslash (), carriage return (\r), and double quotation marks (“”).
Remove a AAA server Use the config { radius | tacplus} authentication { primary | secondary} delete command. 
Device# configure radius authentication primary delete

Enable or disable RADIUS authentication for login user

Procedure

1.

Enable or disable AAA RADIUS authentication for the login user using one of the options.

Option Description
Enable AAA RADIUS authentication for the login user Use the config ap management aaa radius enable command.
Device# config ap management aaa radius enable
Disable AAA RADIUS authentication for the login user Use the config ap management aaa radius disable command.
Device# config ap management aaa radius disable
2.

(Optional) Use the show running-config | include aaa command to verify the AAA server (RADIUS or TACACS+) configuration.

Device# show running-config | include aaa

AAA server configuration:-
===============================
Status: Enabled
AAA server type : radius
Primary RADIUS IP address : 192.0.2.0
Primary RADIUS port : 1812
.
.
.

Enable or disable TACACS+ authentication for login user

Procedure

1.

Enable or disable AAA RADIUS authentication for the login user using one of the options.

Option Description
Enable AAA TACACS+ authentication for the login user Use the config ap management aaa tacplus enable command.
Device# config ap management aaa tacplus enable
Disable AAA TACACS+ authentication for the login user Use the config ap management aaa tacplus disable command.
Device# config ap management aaa tacplus disable
2.

(Optional) Use the show running-config | include aaa command to verify the AAA server (TACACS+) configuration.

Device# show running-config | include aaa

AAA server configuration:-
===============================
Status: Enabled
AAA server type : tacplus
Primary TACPLUS IP address : 192.0.2.0
Primary TACPLUS port : 49
.
.
.

AAA authentication configuration example

When AAA RADIUS authentication is enabled, using the show running-config command generates this sample output.

Device# show running-config 

AAA server configuration:-
===============================
Status: Enabled
AAA server type : radius
Primary RADIUS IP address : 192.0.2.0
Primary RADIUS port : 1812
.
.
.

When AAA TACACS+ authentication is enabled, using the show running-config command generates this sample output.

Device# show running-config 

AAA server configuration:-
===============================
Status: Enabled
AAA server type : tacplus
Primary TACPLUS IP address : 192.0.2.0
Primary TACPLUS port : 49
.
.
.