Use Cloudi-Fi RADIUS for network access and a separate TACACS+ service for network device administration.
Estimated review time: 10–15 minutes. Configuration and pilot testing time depend on your network platform.
Use case
A company wants to authenticate corporate laptops with Cloudi-Fi while keeping its existing rules for switch administrators. Both services involve the same switches, but they answer different questions: can this endpoint join the network, and can this administrator change the switch configuration?
This guide shows how to separate those decisions. The example uses Cloudi-Fi for 802.1X network authentication and an existing TACACS+ service, such as Cisco Identity Services Engine (ISE), for device administration. It is a reference design, not a report of a specific customer deployment.
Choose the service for each access decision
Remote Authentication Dial-In User Service (RADIUS) carries authentication requests and access decisions between network equipment and an authentication server. In an 802.1X deployment, the laptop is the supplicant, the switch or access point is the authenticator, and Cloudi-Fi provides the RADIUS service.
Terminal Access Controller Access-Control System Plus (TACACS+) is commonly used for network device administration. It can separate authentication, authorization, and accounting (AAA), including permission checks and records for individual commands when configured. See RFC 8907 for the protocol definition.
| Decision | Endpoint access | Device administration |
|---|---|---|
| Who is connecting? | A user or endpoint joining Wi-Fi or a wired port | An administrator opening a management session |
| What is requested? | Access to the network | Access to a switch, router, or controller management interface |
| Service in this design | Cloudi-Fi RADIUS for 802.1X | Existing TACACS+ administration service |
| Example policy | Accept a valid corporate certificate and return the intended network profile | Permit diagnostic commands and deny configuration changes for a support role |
| Where is access enforced? | Network equipment applies the supported access policy | The managed device enforces administrative permissions |
| Where should support look? | Cloudi-Fi authentication records and network session logs | Administration AAA records and device logs, including command accounting if enabled |
Some platforms also support RADIUS for administrator login. Choose according to the device's capabilities and your authorization requirements; the protocol name alone does not establish the available command controls.
Map the Cloudi-Fi deployment
Cloudi-Fi Cloud NAC provides the network access service in this example. Network equipment sends the endpoint authentication request to Cloudi-Fi and applies the returned policy supported by the integration. For the detailed roles and exchanges, see the Cloudi-Fi 802.1X overview.
Figure 1. The same network equipment can use separate authentication services for endpoint access and administration. Arrows show logical authentication exchanges.
The administrator service remains on its existing AAA platform. With Cisco ISE, configure the appropriate device administration policy, command sets, and accounting using the Cisco ISE device administration guide.
Prepare the configuration
- Inventory each access service: corporate 802.1X, guest portal, and device administration. Record its current authentication server, network configuration, and owner.
- Identify which server group and authentication policy each service uses. Keep endpoint access and administration settings distinct where the platform supports it.
- Use the current Cloudi-Fi RADIUS settings for 802.1X. Guest portal integrations have separate RADIUS settings; do not assume their server addresses and ports are interchangeable.
- Check the platform-specific Cloudi-Fi integration guide before changing authentication settings. Preserve the approved administrator access and recovery procedure during the pilot.
If the project only moves guest access from ISE, follow ISE guest replacement while retaining 802.1X and TACACS+. That migration has a different scope from moving corporate 802.1X to Cloudi-Fi.
Validate both services
- Connect a permitted test endpoint. Confirm successful Cloudi-Fi authentication and the expected network access.
- Test a rejected endpoint identity and confirm that it does not receive the protected access.
- Sign in to a test network device with an approved support administrator. Verify that permitted diagnostic commands work and a prohibited configuration command is denied.
- Find the corresponding records in each service. A successful network authentication record does not prove that command accounting is enabled.
Troubleshooting
If endpoints authenticate but administrators cannot sign in, check whether a shared or default AAA setting was changed. If administrators can sign in but have excessive permissions, inspect the device administration authorization policy. If authentication succeeds but endpoint access is wrong, check the returned profile and the network equipment's policy enforcement.
The expected result is two independently verified services: Cloudi-Fi controls the configured endpoint authentication flow, and the administration service controls management access to network devices.