Convert 5508 to 9800 - what is the format of pac-password command?

[keithsauer507]

I've run our Cisco 5508 config through the convert tool to the Cisco 9800.  I'm going through all of the !$ lines that indicate they need to be taken care of before applying to the c9800.  

I am not sure how to format this new command.  pac-password <unencrypted/hidden> <server_key>

The 5508 WLC has it as

config flexconnect group NAME radius ap server-key encrypt 1 32hexchars 40hexchars 62hexchars

So 3 groups of hex characters 0-9/a-f.  

I dont understand the format when the example only provides 2 arguments, but yet I have 3 big groups of characters.

[Rich R]

The documentation is a little bit rubbish but you could have worked this out yourself as I just did:
9800(config-eap-method-profile)#pac-password ?
0 Specifies an UNENCRYPTED password will follow
7 Specifies a HIDDEN password will follow
LINE The UNENCRYPTED (cleartext) password
9800(config-eap-method-profile)#pac-password 0 ?
LINE The UNENCRYPTED (cleartext) password
9800(config-eap-method-profile)#pac-password 7 ?
WORD The HIDDEN password string

So it's just like any other standard IOS password: 0 followed by clear text password or 7 followed by reversibly encrypted type 7 password.  If you enter it as clear text and have service password-encryption enabled then IOS will automatically change it to type 7.
eg: "pac-password 0 my-secret-radius-key"

[Scott Fella]

Keep in mind also that you need to really still look at what gets enabled/disabled and what items are new.  These small things can make it very hard to be successful when you migrate.  Sometimes you have to look at it this way, how old is the original configuration and design, and what is broken, what is users complaining about, and try to remediate those things during your testing before you migrate.   I tend to build everything from scratch, because there are items that are so old, you really need to move away from that setting of feature.  This is just my opinion from years of doing this and seeing customers keeping very old configurations which will eventually break with newer clients. 

[Rich R]

Agreed @Scott Fella