topic Re: TACACS+ for ISE CLI Login in Network Access Control

TACACS+ for ISE CLI Login

Sathiyanarayanan Ravindran — Wed, 12 Dec 2018 03:29:56 GMT

Hello,

Am trying to configure TACACS+ for domain based authentication for ISE CLI. But am unable to acheive the same.Below is the configuration am performing at the ISE end.

username ad.1562798 password remote role admin

aaa authentication tacacs+ server 10.0.31.2 key authe

When ever I tried to login am not getting any logs. Am using the same server as TACACS+. Am I missing anything on configuration or TACACS+ login on CLI is not possible on ISE ?

Re: TACACS+ for ISE CLI Login

Surendra — Wed, 12 Dec 2018 03:35:52 GMT

Currently ISE supports only local authentication. You cannot authenticate CLI user using any other method.
Those commands are not even available on ISE. Are you sure you have executed these commands on the ISE CLI ? If yes, which version?

Re: TACACS+ for ISE CLI Login

Sathiyanarayanan Ravindran — Wed, 12 Dec 2018 04:25:02 GMT

Thanks Surendra,

Yes, I have executed this commands on the ISE CLI only. My current Version is 2.4.

Re: TACACS+ for ISE CLI Login

Francesco Molino — Wed, 12 Dec 2018 06:41:07 GMT

Hi

As @Surendra mentioned, you can only use local database to authenticate on ISE CLI. Other methods aren't supported as far as i know (even on 2.4).
I've not checked yet on 2.5.

To be honest, it doesn't make sense to authenticate on himself (tacacs service) because it's stuck, you don't be able to access the Shell and it can be critical.

Re: TACACS+ for ISE CLI Login

Sathiyanarayanan Ravindran — Thu, 11 Apr 2019 22:16:37 GMT

Finally got a solution for having external identity store for CLI login of ISE from version 2.6 🙂

https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/release_notes/b_ise_26_RN.html#id_97053