Wired Intelligent Edge

 View Only
last person joined: yesterday 

Bring performance and reliability to your network with the HPE Aruba Networking Core, Aggregation, and Access layer switches. Discuss the latest features and functionality of your switching devices, and find ways to improve security across your network to bring together a mobile-first solution
Back to discussions
Expand all | Collapse all

Aruba CX Switch HTTPS TACACS Web Authentication

This thread has been viewed 57 times

  • 1.  Aruba CX Switch HTTPS TACACS Web Authentication

    Posted Feb 23, 2021 09:31 AM
    Having some trouble getting the HTTPS web authentication to work when logging into the switch GUI with TACACS but the local switch admin still works.

    Anyone have any insight into this?

    SSH TACACS works great after applying the fragmentation patch. I have allowed level 15 and administrator role in the enforcement profile I just do not see the attempt even making it to ClearPass for the web gui login. Nothing in the event viewer. Here are the CX switch commands I have deployed. 

    aaa authentication login https-server group CP-TEST-TACACS local (Allow HTTPS Login from TACACS? then Local)
    aaa authentication login ssh group CP-TEST-TACACS local (Allow SSH Login from TACACS then Local)
    aaa authorization commands ssh group CP-TEST-TACACS (Authorize SSH commands against TACACS)
    aaa accounting all-mgmt https-server start-stop group CP-TEST-TACACS (Account HTTPS mgmt commands to TACACS)
    aaa accounting all-mgmt ssh start-stop group CP-TEST-TACACS (Account SSH mgmt commands to TACACS)
    aaa accounting port-access start-stop interim 5 group CP-TEST-RADIUS (Account 802.1x port to RADIUS)





    ------------------------------
    Christopher Calhoun
    ------------------------------


  • 2.  RE: Aruba CX Switch HTTPS TACACS Web Authentication

    Posted Aug 18, 2021 03:50 PM
    Did you get this figured out?   I'm having same issue.

    ------------------------------
    Alan Scott
    ------------------------------

    Original Message


  • 3.  RE: Aruba CX Switch HTTPS TACACS Web Authentication

    Posted Aug 19, 2021 04:08 AM
    Had the same problem, Clearpass required some tweaking to get TACACS working on the GUI.

    This is what i have configured in CP, maybe it helps


    Original Message


  • 4.  RE: Aruba CX Switch HTTPS TACACS Web Authentication

    Posted Aug 19, 2021 01:23 PM
    Thanks for sharing I will take a look at that.

    ------------------------------
    Alan Scott
    ------------------------------

    Original Message


  • 5.  RE: Aruba CX Switch HTTPS TACACS Web Authentication

    Posted May 20, 2024 04:47 AM

    Please try to add AMP:https role Admin into Services.



    ------------------------------
    Give me a Kudo when this is useful.

    Ratchapas
    https://www.facebook.com/Aruba-News-Update-1401095559960142
    ------------------------------

    Original Message


  • 6.  RE: Aruba CX Switch HTTPS TACACS Web Authentication

    Posted May 16, 2024 06:30 AM

    TACACS+ is for CLI, RADIUS will be GUI based like the HTTPS Web UI for the switch. You will want to create a Radius profile (Aruba RADIUS Enforcement) then its attributes will be Radius:Aruba Name: Aruba-User-Role and value=administrators. The CX switch has built in group for administrators called administrators. This enforcement profile will get you into the HTTP GUI using RADIUS, since TACACS is for only CLI.


    Original Message


  • 7.  RE: Aruba CX Switch HTTPS TACACS Web Authentication

    Posted Jul 22, 2024 03:26 AM

    I did mbaars suggestion by adding Arbua:Common to my Enforcement Profile for TACACS. While TACACS is usually for CLI, I noticed that Clearpass keeps track of the http endpoints people access just like CLI commands. This can be useful. I haven't tried limiting which endpoints people can access, but I bet you could. 


    Original Message