topic Re: Can't Log Into ISE Web GUI in Network Access Control

Can't Log Into ISE Web GUI

Joe Della Valle — Wed, 28 Aug 2019 16:47:09 GMT

We recently set up a secondary ISE server today. The install completed and everything rebooted fine. However, when I go to log into the Web GUI the system will not accept the Admin creds we created during the initial set up. The odd thing is if I go to the command line and use the same creds, they work fine?

What am I missing?

Re: Can't Log Into ISE Web GUI

Damien Miller — Wed, 28 Aug 2019 17:25:03 GMT

It might be locked out now for what its worth. If you joined it to the deployment, then the GUI admin account would be the same as the primary node (shared).

You can reset the GUI admin account password from the CLI, if you used the default admin during set up then you will use this command.
"application reset-passwd ise admin"

Re: Can't Log Into ISE Web GUI

Joe Della Valle — Wed, 28 Aug 2019 17:32:17 GMT

Damien,

Thanks for a quick reply..

We created a custom user name, so I need to use that for the reset command I know..

It has not been joined to the primary server yet as we usually do it thru the Web GUI.

Again the odd thing is if I go to the command line interface, I can sign into that with the current credentials fine with no issue, so wouldn't that make me believe that they should work at the Web GUI as well?

This is my confusion....

Re: Can't Log Into ISE Web GUI

Jason Kunst — Wed, 28 Aug 2019 19:56:47 GMT

If still having issues work with the TAC as well

Re: Can't Log Into ISE Web GUI

Arne Bier — Thu, 29 Aug 2019 04:02:35 GMT

Hi @Joe Della Valle

The CLI admin login is a separate account to the username used for the GUI login. it's just a happy coincidence that after you install ISE and run the wizard, choose admin/password123 in the wizard, that ISE also creates a GUI account called admin and sets the password as password123. The distinction is not made obvious at the time of install.

Most folks leave the CLI admin as is, and then either disable the GUI admin account or use AD instead. You can also create loads of additional GUI admin accounts.

As Damien pointed out, the application-password (aka "GUI password") can be reset via the CLI - but not vice-versa. If you lock yourself out of the CLI and no way in (but still have GUI access), then you have no choice but to reboot the appliance using the installation .iso and perform a password recovery.

In ISE 2.6 there is a new feature to allow AD accounts to be used to log into the CLI.