topic Re: Import Network Devices into ISE 2.4 Authentication Protocol Required? in Network Access Control

Import Network Devices into ISE 2.4 Authentication Protocol Required?

kevink707 — Fri, 21 Feb 2020 18:55:17 GMT

I'm attempting to import network devices into ISE 2.4.

Following the template found in https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_01001.pdf

The documentation says that Authentication:Protocol:String(6) is optional and the only valid value is "RADIUS".

My import is failing with the message: Failed Value for attribute Protocol is mandatory

Putting TACACS in that field is rejected.

Putting RADIUS in that field is accepted, however then I believe I need to manually edit each device to uncheck Radius (I have tens of thousands of devices so this is not very practical).

Any suggestions?

Re: Import Network Devices into ISE 2.4 Authentication Protocol Required?

Rob Ingram — Fri, 04 May 2018 19:32:02 GMT

Hi,
I don't have access to ISE right now to double check for you, but what I usually do is manually configure 1 NAD with all the values I need. I then export this into a csv, and use that file as the source template. It should therefore have all the fields filled in correctly and hopefully you can then use this as a basis for the import.

If this doesn't work, let me know and I can access my ISE 2.4 in the lab.

HTH

Re: Import Network Devices into ISE 2.4 Authentication Protocol Required?

Ben Walters — Fri, 04 May 2018 19:32:23 GMT

Did you get the template directly from ISE or did you create it yourself based on the values in the document?

This might be a bug or something in your version of ISE I just tried with 2.3 and left the Authentication:Protocol:String(6) value blank for the TACACS devices and they were imported without issue.

I got the template from the Import Device page of ISE with the Generate A Template link

Re: Import Network Devices into ISE 2.4 Authentication Protocol Required?

kevink707 — Fri, 04 May 2018 20:53:01 GMT

Yes, I tried that. If Radius isn't selected the Authentication:Protocol field is left blank on export.

Re: Import Network Devices into ISE 2.4 Authentication Protocol Required?

clint.naude — Mon, 18 Jun 2018 13:24:05 GMT

hi,

did you ever manage to resolve this issue? I am having the same issue and generating a template doesn't work either. I honestly do not want to add thousands of switches manually.

any assistance would be greatly appreciated.

Thank you

Clint

Re: Import Network Devices into ISE 2.4 Authentication Protocol Required?

ajc — Tue, 19 Jun 2018 14:20:32 GMT

Post modified. I realized that you are asking for network devices not endpoints.

Re: Import Network Devices into ISE 2.4 Authentication Protocol Required?

clint.naude — Tue, 19 Jun 2018 05:21:01 GMT

Sorry. how is this going to work? i need to import a boat load of switches, how is a mac address, endpoint and endpoint id group going to move the switches into the correct network device group with the associated ip, mask, name and shared secret?

Do you understand what we are trying to achieve here?

Re: Import Network Devices into ISE 2.4 Authentication Protocol Required?

ajc — Tue, 19 Jun 2018 17:37:46 GMT

IF you have an ACS, export the NETWORK DEVICES DB (see this link:

https://supportforums.cisco.com/t5/aaa-identity-and-nac/acs-5-2-network-devices-export/td-p/1664489

Compare the columns with the template from ISE 2.3 or 2.4 (whatever you want to use) to verify they are the same (I did not do that because I migrated my ACS into ISE 2.3 following the corresponding procedure so all the network devices were moved with no issues - I am running RADIUS/TACACS on ISE 2.3). If they are not the same, just copy and paste on the 2.3 or 2.4 template the values for the corresponding column. You still has manual work to do if you are not migrating from ACS as I said before.

AND I would not go with ISE 2.4 because it is not mature enough (we have talked to Cisco BU about it). However, it is up to you.

Re: Import Network Devices into ISE 2.4 Authentication Protocol Required?

ajc — Tue, 19 Jun 2018 14:47:22 GMT

Let me give a try to the import a Network Device into my ISE 2.3 using the template from this version. I will fill out the columns with 2 entries manually.

Re: Import Network Devices into ISE 2.4 Authentication Protocol Required?

ajc — Tue, 19 Jun 2018 17:36:45 GMT

removed

Re: Import Network Devices into ISE 2.4 Authentication Protocol Required?

ajc — Tue, 19 Jun 2018 17:36:22 GMT

I just finished testing. In order to enable TACACS on the device and avoid errors when importing the CSV, Column G of the template must be empty because it is only for RADIUS. Column H also empty because is related to G.

Re: Import Network Devices into ISE 2.4 Authentication Protocol Required?

clint.naude — Fri, 22 Jun 2018 02:33:16 GMT

Just to update this forum for anyone using ISE 2.4, complete the spreadsheet as normal, but the in Radius column type Radius, even though it will use the Tacacs details for some reason it wants Radius listed in the column.

i imported over 1000 switches with no issues once i added Radius in the column.

Re: Import Network Devices into ISE 2.4 Authentication Protocol Required?

ajc — Fri, 22 Jun 2018 15:09:29 GMT

To be more precise,

Columns G (Authentication:Protocol:String(6)) and H (Authentication:Shared Secret:String(128)) of the template for importing device list to ISE are RADIUS related. So if you need to import devices for Radius AUTHC Only use those ones.

Column AN (TACACS:Shared Secret:String(128)) is the one for TACACS AUTHC so if you only use this authentication mechanism, then leave columns G and H empty.

If you want to use TACACS and RADIUS for the network device, Columns G, H and AN must be completed.

Re: Import Network Devices into ISE 2.4 Authentication Protocol Required?

mumustha — Fri, 13 Jul 2018 01:17:53 GMT

Hi Kevin,

I might be late to the party.

I suspect that this could be caused due to the bug in ISE 2.3/2.4 described in the below link :

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvj13401

A workaround has been defined in the link which is to remove "FALS" under "Enable Multi Shared Secret:String(128)".

Hope that helps

Re: Import Network Devices into ISE 2.4 Authentication Protocol Required?

cnegrete — Wed, 14 Nov 2018 18:32:14 GMT

This is the oddest thing, because if I do an export in ISE 2.4, I get TACACS_PLUS or RADIUS in column G, but when I try to reimport the devices, it barks that TACACS_PLUS is an invalid value.

After deleting TACACS_PLUS from column G, it works with no issues.

Re: Import Network Devices into ISE 2.4 Authentication Protocol Required?

cnegrete — Wed, 21 Nov 2018 03:00:49 GMT

@clint.naude wrote:

Just to update this forum for anyone using ISE 2.4, complete the spreadsheet as normal, but the in Radius column type Radius, even though it will use the Tacacs details for some reason it wants Radius listed in the column.

i imported over 1000 switches with no issues once i added Radius in the column.

Really??? Because I just lost my entire device database (filter something, and the "Delete All" button SHOULD just delete the filtered devices, NOT THE ENTIRE DATABASE).

I'm trying to reimport my devices with column G empty, and the thing stores the shared secret, but DOES NOT ENABLE TACACS FOR THE DEVICE!!!!!!!!!

I'm dying here. First it deletes everything and now it won't accept everything back.

Ah, yes, and the backup is not working so that's a no-go (besides we updated a bunch of rules in the last month).

Re: Import Network Devices into ISE 2.4 Authentication Protocol Required?

Tim K — Thu, 17 Jan 2019 20:42:50 GMT

I had the same issue. I found a bug that has the fix action. I have pasted the results of it below for those that don't have a CCO account. Removing FALSE from the field listed below fixed the problem for me.

ISE "Failed Value for attribute Protocol is mandatory" when importing network device

CSCvj13401

Description

Symptom:
"Failed Value for attribute Protocol is mandatory" error message, when trying to Import Network device through CSV

Conditions:
having NAD that is configured for TACACS and was previously exported from ISE to a CSV

Workaround:
removing "FALS" under "Enable Multi Shared Secret:String(128)" and the import will work fine

Re: Import Network Devices into ISE 2.4 Authentication Protocol Required?

rbrtcrlsn89 — Mon, 12 Aug 2019 03:13:38 GMT

I never EVER post anything on the Cisco forums, however this time I'm going to.

Why is isn't this the answer that's marked as the solution?!?!?!

Thank you sir!

Re: Import Network Devices into ISE 2.4 Authentication Protocol Required?

mumustha — Mon, 12 Aug 2019 05:29:14 GMT

I am glad I was able to inspire.

And please you may skip calling anyone “Sir” here.