topic ISE password lifecycle in Network Access Control

ISE password lifecycle

jonbrown — Tue, 27 Mar 2018 18:38:18 GMT

Hello,

Customer has an evaluation of ISE in their network. They have had to update the GUI password twice (long eval) and have leveraged the command line to do so previously. This morning, they were notified that the GUI password expired but they couldn't leverage the CLI to reset, they were forced to download the ISO in order to recover.

ISE Password recovery mechanisms:

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/200568-ISE-Password-Recovery-Mechanisms.html

They are confident they were typing in the correct password and have the following questions:

- Can they expect this behavior in production?

- Does the GUI password always expire every 45 days?

- is there a configuration parameter to change that?

- What is the password life cycle for CLI password? Is it configurable?

- Other than fat fingering the password, is this expected behavior for evaluation systems?

Re: ISE password lifecycle

hariholla — Tue, 27 Mar 2018 20:07:38 GMT

Disable this option:

Re: ISE password lifecycle

jonbrown — Tue, 27 Mar 2018 21:01:16 GMT

Thanks for the reply, but that field doesn't look it exists in the current version cid:image002.png@01D3C5E9.233FEC40

Re: ISE password lifecycle

hariholla — Tue, 27 Mar 2018 21:08:25 GMT

May be you need to use a different browser / machine. This page scrolls generally. After Password History, comes Password Lifetime option, where the Admin password expiry time can be changed.

~Hari

Re: ISE password lifecycle

jonbrown — Tue, 27 Mar 2018 21:13:28 GMT

Could it be a hidden field in evaluations?

Cheers,

Sent from my iPhone

Re: ISE password lifecycle

Jason Kunst — Tue, 27 Mar 2018 21:18:16 GMT

Evaluation is just the license length of 90 days and is full featured

It’s the same software and menus

Re: ISE password lifecycle

jonbrown — Wed, 28 Mar 2018 02:36:34 GMT

Thanks Jason.

If that’s the case, why don’t they see the option?

Cheers,

Sent from my iPhone

Re: ISE password lifecycle

Jason Kunst — Wed, 28 Mar 2018 11:28:12 GMT

I would recommend they work through the tac if they don’t see the option

Maybe a browser inconsistency

There is no difference in code

Sent from my iPhone

Re: ISE password lifecycle

jonbrown — Wed, 28 Mar 2018 16:42:14 GMT

This is an evaluation, no TAC support.

Why would a configuration parameter be missing in the first place?

This is the OVA they used for the trial, < ISE-2.3.0.298-virtual-eval.ova>

It’s version 2.3, could the parameter have been removed in this version?

Re: ISE password lifecycle

Jason Kunst — Wed, 28 Mar 2018 17:01:50 GMT

Looking at the screenshot comparing to what hari and you have, it looks like they didn't scroll down far enough as its below password history