topic Re: ISE Ver 2.7 authentication Error in Network Access Control

ISE Ver 2.7 authentication Error

okoroji80 — Fri, 10 Jul 2020 17:50:47 GMT

I istalled an ISE server recently ,configured by Cisco Switch for tacacs authentication,

I constantly get failed login attempts while trying to login.

Attached herewith is the error log. Below is my switch Configuration:

aaa group server tacacs+ ISE-DMO
server 16.128.15.75
server-private 16.128.15.75 key man&woman
!
aaa authentication login default group tacacs+ local
aaa authentication enable default group tacacs+ enable
aaa authentication dot1x default group packetfence
aaa authorization exec default group tacacs+ local
aaa authorization network default group packetfence
aaa accounting commands 1 default start-stop group tacacs+
aaa accounting commands 7 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+

tacacs-server host 16.128.15.75
tacacs-server directed-request
radius-server host 10.128.10.150 auth-port 1812 acct-port 1813 timeout 2 key man&men
radius-server vsa send authentication
!
control-plane
!
!
line con 0
line vty 0 4
password done2020
line vty 5 15
password done2020

Re: ISE Ver 2.7 authentication Error

marius.jakevicius — Fri, 10 Jul 2020 18:43:34 GMT

How does policy on ISE looks like?

Re: ISE Ver 2.7 authentication Error

okoroji80 — Fri, 10 Jul 2020 21:02:17 GMT

Hello Marius.,

Attached is my policy set on the ISE.

thank you

Re: ISE Ver 2.7 authentication Error

hslai — Sat, 11 Jul 2020 18:29:30 GMT

Both of your two non-default authorization rules have conditions on user identity groups. ISE appears not finding the user in either groups so it applies the default; hence, Deny All Shell Profile.

Re: ISE Ver 2.7 authentication Error

okoroji80 — Sat, 11 Jul 2020 21:47:33 GMT

Kindly advice on the steps to have this resolved

thanks

Re: ISE Ver 2.7 authentication Error

hslai — Sat, 11 Jul 2020 23:01:38 GMT

okoroji80,

Please verify whether the user in one of the user groups.

Or, you may change the shell profile and the command set for the default rule and give some limited access.