topic Device Support for TACACS Functionality on ISE 2.1 in Network Access Control

Device Support for TACACS Functionality on ISE 2.1

Runner888 — Thu, 13 Oct 2016 13:24:12 GMT

Hi All--I have a couple of questions regarding TACACS in ISE as I'm in the planning stage to migrate from ACS 5.8 to ISE 2.1.

1) Does anyone know if there is documentation available listing devices (Cisco and non-Cisco) that are supported for TACACS functionality in ISE 2.1? I know there's a device compatibility listing for ISE but I don't believe it includes TACACS functionality.

2) Can I export/import AAA clients in ISE to a CSV file much like ACS?

3) Similar to question #2, can I import the AAA client list that was exported from ACS and imported into ISE?

Thanks in advance.

~Keith

Re: Device Support for TACACS Functionality on ISE 2.1

hslai — Thu, 13 Oct 2016 13:42:19 GMT

1. T+ is part of AAA.

2. Yes. We would export both the network device groups and the network devices.

3. Yes, but the CSV files from ACS need modifying so that columns matched with the CSV import templates of the target ISE release.

Re: Device Support for TACACS Functionality on ISE 2.1

Runner888 — Fri, 14 Oct 2016 04:37:20 GMT

Hi--Thanks again for the info and screenshot. For my clarification to question #1 in terms of device compatibility support for TACACS, are you saying that whatever is listed in the "Cisco Identity Services Engine Network Component Compatibility, Release 2.X" doc under "Table 1 Supported Network Access Devices" in the AAA column applies to TACACS? If that is the case, then it is a very short list of support devices for TACACS functionality in ISE 2.1. I notice that some Cisco devices were not listed such as Nexus, ASA or ASR routers not to mention other non-Cisco device models. Does this mean I won't be able to leverage ISE's TACACS functionality to manage Nexus, ASA, and/or ASR devices? I hope this is not the case--otherwise it's a show stopper for those who are looking to replace ACS with ISE 2.1.

Re: Device Support for TACACS Functionality on ISE 2.1

hslai — Fri, 14 Oct 2016 14:30:07 GMT

For IOS devices, you may expect T+ to work according to the matrix. You are correct that T+ support list a lot longer and to include NX-OS, PI, etc., as it needs no DACL, url redirects, and so on, as the RADIUS counterpart for endpoints.