topic Re: TACACS+ for Network User Authentication in Network Access Control

TACACS+ for Network User Authentication

scamarda — Wed, 28 Jun 2017 12:35:38 GMT

If I am not mistaken, with ACS you could use TACACS+ as the NAD protocol to authenticate network users. Looking through the documentation and menus, I do not see that capability in ISE. Is this configuration possible? Or is TACACS+ in ISE solely for Dev Admin?

Re: TACACS+ for Network User Authentication

ldanny — Wed, 28 Jun 2017 13:27:57 GMT

Hi,

ACS can use T+ for Network Access as long your in no need of EAP which is not supported , hence the use of Radius for NA.

To answer your question ISE uses Radius for Network Access and T+ for Device Management only.

-Danny

Re: TACACS+ for Network User Authentication

Jason Kunst — Wed, 28 Jun 2017 13:48:14 GMT

Can you please explain the use case

Re: TACACS+ for Network User Authentication

kthiruve — Wed, 28 Jun 2017 20:31:36 GMT

Just to clarify,

Endpoint authentication such as dot1x and MAB, CWA uses RADIUS as a backend protocol. These services generally refers to Network access and RADIUS is used in that context and ACS supports RADIUS. ACS support dot1x and MAB in that context.

Device administration can use TACACS+ or RADIUS. However TACACS+ is the prevalently used method since it support authentication, session authorization, command authorization and accounting. It offers greater flexibility for Device management and audit. RADIUS protocol can be used by Third party devices that do not support TACACS+. RADIUS authorization needs to send the attributes during authorization for that.

ISE has all the protocol support as that of ACS. ISE 2.0 started supporting TACACS+. If you are using ISE version prior to ISE 2.0 you many not see that. TACACS+ is a service that needs to be enabled in the UI under Administration --> Deployment for that ISE node. We have a workcenter for Device administration where you see relevant information.

-Krishnan