Network Access · Topic 8 of 9
AP and WLC Management Access
Compare ways to manage an access point or wireless controller: console, Telnet, SSH, HTTP, HTTPS, plus TACACS+ or RADIUS for admin authentication.
- 6 min
- Exam objective 2.8
- Console is local and does not need the network.
- Telnet and HTTP send data in clear text. SSH and HTTPS encrypt.
- The default secure choice is SSH for the CLI and HTTPS for the GUI.
What it is
Access points and controllers can be managed in several ways, and some are secure while others are not.
Access points and wireless LAN controllers (WLCs) need to be configured and monitored. The choice of method affects both convenience and risk.
This topic compares the main management access methods, and explains how an external server can control who is allowed to log in.
How it works
You pick an access method, then decide where administrator logins are checked.
Access methods
| Method | Port | Encrypted | Notes |
|---|---|---|---|
| Console | Physical cable | n/a | Local access, works even when the network is down |
| Telnet | TCP 23 | No | Text in the clear, avoid |
| SSH | TCP 22 | Yes | Secure command line access |
| HTTP | TCP 80 | No | Web interface without protection |
| HTTPS | TCP 443 | Yes | Secure web interface |
Console is a direct serial or USB connection to the device. It does not depend on the network, which makes it the access method of last resort, for example during first setup or when remote access is broken. It also needs physical presence.
Telnet gives a command line session across the network, but everything, including the password, is sent as clear text. Anyone able to capture the traffic can read it.
SSH gives the same command line session with encryption. It should replace Telnet wherever possible.
HTTP and HTTPS give access to the graphical management interface in a browser. HTTP sends everything unencrypted. HTTPS wraps the session in TLS.
Management through the web interface should use HTTPS.
On a WLC, each of these can be enabled or disabled in the management settings. A common hardening step is to turn off Telnet and HTTP and leave only SSH and HTTPS.
The default state of each method depends on the controller type and software version, so check it and switch off what you do not need.
An AP managed by a controller is rarely configured directly. You usually manage it through the WLC. Direct access to the AP console is still available for troubleshooting, and SSH or Telnet to the AP can be enabled from the controller.
Another way to monitor devices is SNMP, which is covered in the IP Services chapter.
Authenticating administrators
Local usernames on every device are hard to manage. Instead, you can point the device at a central server that checks credentials. The two protocols for this are RADIUS and TACACS+.
| Feature | RADIUS | TACACS+ |
|---|---|---|
| Origin | Open standard | Cisco protocol |
| Transport | UDP | TCP |
| Ports | 1812 authentication, 1813 accounting | 49 |
| Encryption | Password only | Whole payload |
| AAA split | Combines authentication and authorization | Keeps all three separate |
| Typical use | Network access, such as Wi-Fi and VPN | Device administration |
RADIUS officially uses UDP 1812 for authentication and 1813 for accounting. Some older Cisco software defaulted to 1645 and 1646.
Because TACACS+ separates authorization from authentication, it can control exactly which commands each administrator may run. That is why it is the usual choice for device administration. RADIUS is the usual choice for letting users onto the network, for example with 802.1X on wireless.
Both protocols are covered under AAA in the Security Fundamentals chapter. For the controller, you add the server's address and a shared secret, and then tell the device to use it for management logins.
A good practice is to keep a local account as a fallback in case the server cannot be reached.
Cloud-managed access
Some networks manage devices from a vendor's cloud dashboard instead of logging in to each device or to a local controller. Cisco Meraki is a common example.
The device connects out to the cloud service over HTTPS. The administrator signs in to the dashboard in a browser and makes changes there. The cloud then pushes the configuration to the device.
A local controller such as a WLC runs inside your own network. A cloud-managed system runs in the vendor's cloud, so one dashboard can manage many sites.
Changes need a working connection to the cloud. If the link drops, devices normally keep forwarding traffic with the last configuration, but you cannot manage them until it returns.
Protect the dashboard accounts with strong authentication, such as multifactor authentication.
Good practice summary
- Use SSH and HTTPS, not Telnet and HTTP.
- Authenticate administrators centrally, with TACACS+ where it is available.
- Restrict management access to a management network.
- Keep the console for emergencies and protect it physically.
What to remember for the exam
Nine facts cover most questions on this topic.
- Console is local and does not need the network.
- Telnet and HTTP send data in clear text. SSH and HTTPS encrypt.
- The default secure choice is SSH for the CLI and HTTPS for the GUI.
- TACACS+ uses TCP port 49 and encrypts the full payload.
- RADIUS uses UDP, with ports 1812 and 1813, and encrypts only the password.
- TACACS+ separates authentication, authorization and accounting. RADIUS combines authentication and authorization.
- TACACS+ is typical for device administration. RADIUS is typical for network access.
- Keep a local fallback account in case the server is unavailable.
- Cloud managed devices are administered from a vendor's cloud dashboard over HTTPS. A lost internet link stops management, not normal forwarding.
TACACS+ is TCP and encrypts everything, so use it for device administration. RADIUS is UDP and encrypts only the password, so it suits network access.
Common mistakes
These five mistakes are common.
Leaving Telnet or HTTP enabled. These expose passwords on the network. Turn them off once SSH and HTTPS work.
Mixing up the two server protocols. TACACS+ is TCP and encrypts everything. RADIUS is UDP and encrypts only the password.
Locking yourself out. If you enforce server authentication and the server is unreachable, you may have no way in. Test the fallback first.
Believing console access is insecure because it is local. It is protected by physical access, but it still needs a password and a locked room.
Forgetting the shared secret. The device and the server must use the same secret, or authentication fails.
Do not enforce server only logins before testing the local fallback account, or a server outage can lock every administrator out.
Check yourself
Work through these three prompts.
What can an eavesdropper see with Telnet versus SSH, and with HTTP versus HTTPS?
Telnet and HTTP send everything, including passwords, in clear text, so an eavesdropper can read it. SSH and HTTPS encrypt the session.
Why might a network team choose TACACS+ for administrators and RADIUS for wireless users?
TACACS+ keeps authorization separate from authentication, so it can control exactly which commands each administrator may run, which suits device administration. RADIUS is the usual choice for letting users onto the network, for example with 802.1X on wireless.
What does a local fallback account protect against?
It protects against lockout when the authentication server is unreachable, because administrators can still log in with the local account.
Topic 8 of 9 in Network Access
Test yourself on Network Access
The full Cisco CCNA 200-301 question bank has 1,206 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.