topic Re: Does FMC/FTD support ISE Tacacs+ device administration in Network Access Control

Does FMC/FTD support ISE Tacacs+ device administration

laurathaqi — Thu, 29 Apr 2021 10:51:42 GMT

Hi all,

Do you know if FMC and FTD support ISE Tacacs+ device administration integration? So far, I did the router/switch and ASA integrations, but not able to find resources for the noted FTD and FMC ones!

Looking forward to hearing any thoughts or suggestions.

Thank you,

Laura

Re: Does FMC/FTD support ISE Tacacs+ device administration

balaji.bandi — Thu, 29 Apr 2021 11:12:21 GMT

how about using Radius ? as of i have tested 6.2

https://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/200204-Integration-of-FireSIGHT-System-with-ACS.html

May be need to read what 6.7 (any update on that)

Re: Does FMC/FTD support ISE Tacacs+ device administration

Rob Ingram — Thu, 29 Apr 2021 11:33:24 GMT

@laurathaqi

No TACACS+ is still not supported on the FMC, you can use RADIUS.

Use the "class" RADIUS attributes in AuthZ profiles.

Class=Administrator

Class=SecAnalyst

And map these to roles in the FMC (System > Users > External Authentication).

So for example on the FMC if you want to configure the Security Analyst role then define Class=SecAnalyst or for administrator role define Class=Administrator.

HTH

Re: Does FMC/FTD support ISE Tacacs+ device administration

laurathaqi — Thu, 29 Apr 2021 11:49:54 GMT

Hi @Rob Ingram @balaji.bandi

Thank you for your feedback! Highly appreciated. Due to limited testing resources, I need to ask you if this is valid for only FMC or also FTD's?!

The solution you described, I found it on portals, as a solution to be enabling FMC GUI Authentication. My intentions are to do that for the CLI access of both FMC and also two FTDs

Looking forward to hearing from you.

Thank you,

Laura

Re: Does FMC/FTD support ISE Tacacs+ device administration

balaji.bandi — Thu, 29 Apr 2021 12:17:15 GMT

Its for both, you can use Radius only with Attributes mentioned also provided link have all the information

any issue please let us know, happy to assists further.

Re: Does FMC/FTD support ISE Tacacs+ device administration

Rob Ingram — Thu, 29 Apr 2021 12:28:32 GMT

The RADIUS attributes values previously provided where for FMC. Use the following in AuthZ profile for FTDs

"Radius:Service-Type = Administrative (6)" << for Administrator
"Radius:Service-Type = Login (1)" << for non-administrator

Re: Does FMC/FTD support ISE Tacacs+ device administration

Marvin Rhoads — Thu, 29 Apr 2021 14:49:02 GMT

As the others have noted - plus make sure you tick the box to include shell authentication to make the setting apply to the cli logins on FMC and FTD. That's not selected by default.

Re: Does FMC/FTD support ISE Tacacs+ device administration

laurathaqi — Wed, 05 May 2021 12:16:48 GMT

Dear community,

Thank you very much for the support provided. I have followed your advices and resulted in a successful integration.

This community is awesome.

Thank you,

Laura

Re: Does FMC/FTD support ISE Tacacs+ device administration

samarthashetty — Thu, 14 Jul 2022 15:32:11 GMT

Hi Experts,

Is this supported in ver 6.7?

-Samarth

Re: Does FMC/FTD support ISE Tacacs+ device administration

Marvin Rhoads — Thu, 14 Jul 2022 15:40:27 GMT

No it's not supported in any version - even in the latest version 7.2.

Re: Does FMC/FTD support ISE Tacacs+ device administration

balaji.bandi — Thu, 14 Jul 2022 15:40:58 GMT

as per @laurathaqi input that works.

Re: Does FMC/FTD support ISE Tacacs+ device administration

samarthashetty — Thu, 14 Jul 2022 15:53:44 GMT

@balaji.bandi was that not for Radius?

-samarth

Re: Does FMC/FTD support ISE Tacacs+ device administration

Alex Martin — Fri, 21 Feb 2025 02:03:14 GMT

Ugh... 2025 and SourceFire (FirePower/FMC/etc...) has long been a Cisco company and we can't seem to get TACACS (a Cisco proprietary solution) integrated into this platform. This company has some serious personal identity issues...

Re: Does FMC/FTD support ISE Tacacs+ device administration

MAP_2k — Thu, 19 Jun 2025 20:10:53 GMT

Here's a great source for the steps to follow, for anyone falling onto this thread.

https://www.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/221009-configure-fmc-and-ftd-external-authentic.html