topic ISE cli user in Network Access Control

ISE cli user

asmlicense — Wed, 28 Jul 2021 07:08:09 GMT

hi everyone,

the problem - unfortunately we have just 1 cli admin user and we have know idea what is the password. after how many unsuccessful attempts user is going to blocked state and how long it will be in blocked state. if forever so we have to start the recovery process.

thanks in advance

Re: ISE cli user

balaji.bandi — Wed, 28 Jul 2021 08:14:11 GMT

yes i have seen this same case on ACS also, they try to attempt more than 3 times it locks, you only have option to recover using recover CD. same case with ISE, once it blocked its blocked i guess. (since we always use central authnetication or different admin account to save main user admin account for emergency). ISE has same username GUI and CLI,

if you like to add one more user for CLI admin you an use same syntax and test it.

"username <username> password plain <cleartext password> role admin"

Re: ISE cli user

asmlicense — Wed, 28 Jul 2021 09:03:21 GMT

As I know GUI and CLI user are not the same. Because we have some GUI users and can not open CLI via them.

Do you know how long downtime will be while password recovery process?

Re: ISE cli user

balaji.bandi — Wed, 28 Jul 2021 09:35:17 GMT

it take 20-40min as per my experience depends device reboot times

here is proceedure.

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/200568-ISE-Password-Recovery-Mechanisms.html

Re: ISE cli user

asmlicense — Wed, 28 Jul 2021 09:46:18 GMT

Thanks a lot