FortiNAC Integrate with cisco WLC

[SivaG]

Dear all,

We configured the SNMPv3 in Cisco WLC and it's connected with FortiNAC successfully. Also configured user account with highest privilege for CLI settings. We avoided special characters in the password as well. While validating the credentials getting below error message, anyone experienced this issues.

SNMP connect succeeded.However device failed to connect using CLI credentials.Device either does not support a CLI or credentials are invalid.

Any suggestions,

[AEK]

Hi Siva

What is the WLC model?

Try it with the default WLC's admin user, just to check the behavior.

Also try connect from FNAC's CLI to the WLC and see if it works fine.

Also, did you change the default CLI prompt of your WLC? E.g. replaced the default "$", or ">" or any other by a custom sign/string?

[SivaG]

Dear AEK, 

What is the WLC model? / Cisco Catalyst 9800-40 Wireless Controller

Try it with the default WLC's admin user, just to check the behavior./ Tried no luck

Also try connect from FNAC's CLI to the WLC and see if it works fine. / From FNAC CLI is working 

Also, did you change the default CLI prompt of your WLC? E.g. replaced the default "$", or ">" or any other by a custom sign/string? / No, we are using the default one.

While we checking the logs, FNAC can able to connect but getting error while executing the command for Mac table. Find the below log message for your ref.

yams INFO :: 2025-11-13 13:33:20:528 :: #1017 :: SSH2: Authentication to 10.x.x.x succeeded
10.x.x.x
yams INFO :: 2025-11-13 13:33:32:741 :: #1017 :: TelnetSession.waitfor() ip = 10.x.x.x num bytes = 159
yams.TelnetServer INFO :: 2025-11-13 13:33:32:741 :: #1017 :: Warning: failed to execute CLI commands for IT-9800-WLC01 at 10.x.x.x.

Any suggestions / inputs ?

[AEK]

Dear Siva

From the same logs try find which command it is running, then run the same on your WLC to double check if the command is correct or wrong.

[AEK]

Other things to check..

The WLC firmware version must be supported. For the supported versions you can check on the FNAC doc for integrating this WLC.

Also make sure you didn't forget the enable password on FNAC credentials for your WLC, in case it is configured on WLC.

[SivaG]

Dear Tek,

We couldn't find the commands which is trying to execute, Find the below detailed logs. here 10.x.x.x is WLC

org.apache.sshd.common.io.nio2.Nio2ServiceFactory FINE :: 2025-11-13 13:57:59:335 :: #3600 :: close(org.apache.sshd.common.io.nio2.Nio2ServiceFactory@c4c172c)[Immediately] closed
org.apache.sshd.common.util.closeable.SequentialCloseable FINEST :: 2025-11-13 13:57:59:335 :: #3600 :: doClose(org.apache.sshd.common.util.closeable.SequentialCloseable$1@62cff9d9) closing [DefaultCloseFuture[id=SshClient[6c432324]][value=null]] immediately=true
org.apache.sshd.common.util.closeable.SequentialCloseable FINE :: 2025-11-13 13:57:59:335 :: #3600 :: doClose(org.apache.sshd.common.util.closeable.SequentialCloseable$1@62cff9d9) signal close complete immediately=true
org.apache.sshd.client.SshClient FINE :: 2025-11-13 13:57:59:335 :: #3600 :: close(SshClient[6c432324])[Immediately] closed
yams INFO :: 2025-11-13 13:57:59:817 :: #1017 :: TelnetSession.waitfor() ip = 10.x.x.x. num bytes = 159
yams.TelnetServer INFO :: 2025-11-13 13:57:59:817 :: #1017 :: Warning: failed to execute CLI commands for MDF1-IT-9800-WLC01 at 10.x.x.x.
yams INFO :: 2025-11-13 13:57:59:818 :: #148788 :: 10.x.x.x. Connection Closed

org.apache.sshd.client.channel.ChannelShell FINE :: 2025-11-13 13:57:59:817 :: #1017 :: close(ChannelShell[id=0, recipient=3]-ClientSessionImpl[netadmin@/10.x.x.x.:22]) Closing gracefully
org.apache.sshd.client.channel.ChannelShell FINE :: 2025-11-13 13:57:59:818 :: #1017 :: close(ChannelShell[id=0, recipient=3]-ClientSessionImpl[netadmin@/10.x.x.x.:22]) no EOF sent
org.apache.sshd.client.channel.ChannelShell FINEST :: 2025-11-13 13:57:59:818 :: #1017 :: signalChannelClosed(ChannelShell[id=0, recipient=3]-ClientSessionImpl[netadmin@/10.x.x.x.:22])[signalChannelClosed]
org.apache.sshd.common.channel.LocalWindow FINE :: 2025-11-13 13:57:59:818 :: #1017 :: Closing LocalWindow[client](ChannelShell[id=0, recipient=3]-ClientSessionImpl[netadmin@/10.x.x.x.:22])
org.apache.sshd.common.channel.RemoteWindow FINE :: 2025-11-13 13:57:59:818 :: #1017 :: Closing RemoteWindow[client](ChannelShell[id=0, recipient=3]-ClientSessionImpl[netadmin@/10.x.x.x.:22])
org.apache.sshd.common.util.closeable.SequentialCloseable FINEST :: 2025-11-13 13:57:59:819 :: #1017 :: doClose(org.apache.sshd.common.util.closeable.SequentialCloseable$1@7178c760) closing SequentialCloseable[DefaultCloseFuture[id=Builder][value=null]] immediately=false
org.apache.sshd.common.util.closeable.SequentialCloseable FINEST :: 2025-11-13 13:57:59:819 :: #1017 :: doClose(org.apache.sshd.common.util.closeable.SequentialCloseable$1@26ca709) closing FuturesCloseable[DefaultCloseFuture[id=ChannelShell[id=0, recipient=-1]-ClientSessionImpl[netadmin@/10.x.x.x.:22]][value=null]] immediately=false
org.apache.sshd.common.util.closeable.FuturesCloseable FINEST :: 2025-11-13 13:57:59:819 :: #1017 :: doClose(false) future pending: 2
org.apache.sshd.common.util.closeable.FuturesCloseable FINEST :: 2025-11-13 13:57:59:819 :: #1017 :: doClose(false) complete pending: 1
org.apache.sshd.common.util.closeable.FuturesCloseable FINEST :: 2025-11-13 13:57:59:819 :: #1017 :: doClose(false) complete pending: 0
org.apache.sshd.common.util.closeable.SequentialCloseable FINEST :: 2025-11-13 13:57:59:819 :: #1017 :: doClose(org.apache.sshd.common.util.closeable.SequentialCloseable$1@26ca709) closing [DefaultCloseFuture[id=ChannelShell[id=0, recipient=3]-ClientSessionImpl[netadmin@/10.x.x.x.:22]][value=null]] immediately=false
org.apache.sshd.client.channel.ChannelShell FINEST :: 2025-11-13 13:57:59:820 :: #1017 :: close(ChannelOutputStream[ChannelShell[id=0, recipient=3]-ClientSessionImpl[netadmin@/10.x.x.x.:22]] SSH_MSG_CHANNEL_DATA) closing
org.apache.sshd.client.channel.ChannelShell FINE :: 2025-11-13 13:57:59:820 :: #1017 :: sendEof(ChannelShell[id=0, recipient=3]-ClientSessionImpl[netadmin@/10.x.x.x.:22]) SSH_MSG_CHANNEL_EOF (state=Graceful)

[AEK]

Try using this command, and it should show what we are looking for.

exec enter-shell
device -ip 10.x.x.x -setAttr -name DEBUG -value "TelnetServer ForwardingInterface"
tail -f /bsc/campusMgr/master_loader/logs/output.master | grep ":: write = "

[SivaG]

Dear AEK, 

Find the below CLI output,

fnacvm-01:~$ device -ip 10.x.x.x -setAttr -name DEBUG -value "TelnetSer ver ForwardingInterface"
************************* IT-9800-WLC01 *************************
Landscape = 345051318706 00:50:56:A9:49:B2
Pollable = true, Poll interval = 10 Minutes
Type = GenericSNMPSwitch
Group = 1.3.6.1.4.1.9
MAC = null
Protocol = SnmpV1
Description = Cisco IOS Software [Cupertino], C9800 Software (C9800_IOSXE-K9), V ersion 17.9.4a, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2023 by Cisco Systems, Inc.
Compiled Fri 20-Oct-23 10:31 by mcpre
IP = 10.x.x.x.
Role = NAC-Default
State = Active
Status = Established
DBID = 3313
Attribute Count = 54
Name = SNMPV3_USER_CONTEXT value = **** Name = CLI_CREDENTIALS value = C LICredentials
User Name:[netadmin]
Password:[***]
Enable Password:[***]
SessionType:[SSH2]
Name = userDefinedOID value = false length = 5
Name = FirmwareVersion value = Airespace.IOSXE length = 15
Name = AirespaceVersion value = 17.9 length = 4
Name = Weight value = 10 length = 2
Name = L3_ENABLED value = true
Name = L3_POLL_DURATION value = 600
Name = L3_POLL_PRIORITY value = 1
Name = L3_LAST_POLL value = Fri Nov 14 10:29:56 AST 2025 length = 28
Name = L3_LAST_SUCCESSFUL_POLL value = Fri Nov 14 10:29:56 AST 2025 leng th = 28
Name = RadiusServerConfigId value = 1 length = 1
Name = ClearMethod value = radius length = 6
Name = RadiusAttributeGroupId value = 1 length = 1
Name = GuestRadiusAttributeGroupId value = null
Name = DefaultRadiusAttributeGroupId value = null
Name = RegistrationRadiusAttributeGroupId value = null
Name = RemediationRadiusAttributeGroupId value = null
Name = AuthenticationRadiusAttributeGroupId value = null
Name = Dead EndRadiusAttributeGroupId value = null
Name = GuestAction value = 1 length = 1
Name = DumbAction value = 0 length = 1
Name = RadiusSecret *****
Name = UnRegAction value = 0 length = 1
Name = AuthVlanIDWireless value = length = 0
Name = DefaultVlanIDWireless value = 609 length = 3
Name = RadiusMode value = Local length = 5
Name = QuarantineAction value = 0 length = 1
Name = UnRegVlanIDWireless value = length = 0
Name = GuestVlanID value = length = 0
Name = AuthAction value = 1 length = 1
Name = DumbVlanID value = length = 0
Name = DefaultVlanID value = 609 length = 3
Name = Dot1xAutoRegister value = false length = 5
Name = QuarantineVlanIDWireless value = length = 0
Name = DefaultAction value = 2 length = 1
Name = VlanFormat value = id length = 2
Name = DumbVlanIDWireless value = length = 0
Name = QuarantineVlanID value = length = 0
Name = UnRegVlanID value = length = 0
Name = AuthVlanID value = length = 0
Name = ACLSwitchingEnable value = false length = 5
Name = RadiusEnabled value = true length = 4
Name = L2_ENABLED value = true length = 4
Name = L2_POLL_DURATION value = 3600 length = 4
Name = L2_LAST_POLL value = Tue Nov 11 14:35:47 AST 2025 length = 28
Name = VlanSwitchingEnable value = true length = 4
Name = PhysicalAddressFilteringEnabled value = false length = 5
Name = EnablePASwitchingOptimization value = false length = 5
Name = UsesSNMP value = false length = 5
Name = ImageType value = GenericSNMPSwitch length = 17
Name = SnmpVersion value = 1 length = 1
Name = MultiKnownHostEntries value = true length = 4
Name = DEBUG value = TelnetServer ForwardingInterface length = 32
*****************************************************************

fnacvm-01:~$ tail -f /bsc/campusMgr/master_loader/logs/output.master | grep ":: write = "
yams INFO :: 2025-11-14 10:32:12:506 :: #132917 :: write = ***************
yams INFO :: 2025-11-14 10:32:18:065 :: #3601 :: write = terminal length 0
yams INFO :: 2025-11-14 10:32:18:081 :: #3599 :: write = terminal length 0
yams INFO :: 2025-11-14 10:32:30:067 :: #132917 :: write = ***************
yams INFO :: 2025-11-14 10:32:47:631 :: #132917 :: write = ***************
yams INFO :: 2025-11-14 10:33:27:187 :: #3600 :: write = terminal length 0
yams INFO :: 2025-11-14 10:33:58:069 :: #3600 :: write = terminal length 0
yams INFO :: 2025-11-14 10:35:01:466 :: #3599 :: write = terminal length 0
yams INFO :: 2025-11-14 10:35:14:502 :: #973 :: write = ***************
yams INFO :: 2025-11-14 10:35:32:083 :: #973 :: write = ***************
yams INFO :: 2025-11-14 10:37:59:904 :: #99 :: write = enable
yams INFO :: 2025-11-14 10:37:59:921 :: #99 :: write = ***************
yams INFO :: 2025-11-14 10:37:59:947 :: #99 :: write = terminal length 0
yams INFO :: 2025-11-14 10:38:11:139 :: #3599 :: write = terminal length 0
^C

[AEK]

Dear Siva

Here it should show every commend entered in the WLC shell.

I guess you replaced some commands by "****". Do you see any wrong command in the output?

The issue should be: either a wrong command has been entered (less probable), or an unexpected output has been returned by the WLC.

You can use with the same command (without grep) to try find if there is anything wrong with the input/output.

[AEK]

By the way did you follow this guide?

https://docs.fortinet.com/document/fortinac-f/7.6.0/cisco-wireless-controller-integration/894551/ove...