topic ISE configuration data restore CLI account in Network Access Control

ISE configuration data restore CLI account

Madura Malwatte — Thu, 11 Apr 2019 11:41:14 GMT

Just want to confirm, when a configuration data backup from another node is restored on a local node, does the existing CLI and GUI account credentials get overwritten by the one's from the backup? So I will no longer be able to get into the CLI and GUI with the old credentials? And only way to reset the password is then using the methods outlined here ?

Re: ISE configuration data restore CLI account

paul — Thu, 11 Apr 2019 13:28:52 GMT

I believe the restore will only affect the GUI admin password, but it has been a while since I tested this. My admin accounts for CLI and GUI are usually kept the same. The only time those accounts are matched are during the initial setup script. After the initial script the CLI and GUI accounts are managed independently. The restore should only be restoring the ISE application information which contains the GUI password. The link you put in your post is the way to reset both the CLI and GUI passwords.

Re: ISE configuration data restore CLI account

Nadav — Thu, 11 Apr 2019 15:29:53 GMT

The GUI admins are shared configuration for the deployment. So whatever GUI admins are in the backup is what you'll have for all nodes in the deployment after restoring.

As for CLI admins, that's per node. When you restore via CLI you have the option of restoring ADE-OS (via the "include-adeos" keyword). If you do so that also includes the local CLI users for the relevant nodes.

Re: ISE configuration data restore CLI account

Madura Malwatte — Fri, 12 Apr 2019 12:47:57 GMT

Hi Nadav,

This is exactly it. When I have done restore's before I never included the ADE-OS, hence why the existing CLI accounts always worked. This latest restore I used "include-adeos", and it wiped out the existing account.

I couldn't find much info about what the ADE-OS includes, but seems it includes the network settings such as IP address, ntp, domain, hostname, CLI account, etc? There is not much mention what it does in administrator guide.

Re: ISE configuration data restore CLI account

Nadav — Fri, 12 Apr 2019 20:05:29 GMT

I'd imagine it's the entirety of your ADE-OS. Basically everything you see under "show run", and maybe also the system logs.