topic ISE Radius device administration authentication possible? in Network Access Control

ISE Radius device administration authentication possible?

joerg — Mon, 11 Mar 2019 02:39:31 GMT

Hi,

does anybody know if Radius device administration authentication and authorization is possible with the actual ISE release? I know that TACACS will be available in future release.

Regards

Joerg

ISE Radius device administration authentication possible?

Eduardo Aliaga — Thu, 11 Oct 2012 07:12:46 GMT

Yes it's possible according to "Ask the experts" forum :

--------------------------

https://supportforums.cisco.com/thread/2172532

"If you use RADIUS for device administration, ISE can be utilized using authorization policy elements that return Cisco av-pairs. But personally, I think ACS is currently superior to ISE for this task."

--------------------------

Anyway, I'm about to test "device admin" and "network access" simultaneously in the same switch with Radius and ISE.

Please rate if it helps

ISE Radius device administration authentication possible?

joerg — Fri, 12 Oct 2012 08:01:15 GMT

Hi,

thanks for your feedback.

Please post the results of your tests when have done them.

Regards

Joerg

ISE Radius device administration authentication possible?

Tarik Admani — Fri, 12 Oct 2012 15:49:39 GMT

Yes you can use radius even in the ACS days for device administration, however command authorization is not a feature that works efficiently with radius.

If you are using IOS devices your authorization policy should send back the "cisco-av-pair=priv-lvl=15". Please consult the product documentaiton for a radius authentication and the radius av pair should be present in most guides. I know you can do this with IOS, NX_OS, WLC devce to name a few.

Thanks,

Tarik Admani
*Please rate helpful posts*