topic ISE CLI Connection Problem in Network Access Control

ISE CLI Connection Problem

CansuTkr1 — Mon, 11 Mar 2019 06:04:59 GMT

Hi ,

We use ISE version 1.2 and I have two admin , 2 monitoring and 8 psn node . Now I can't login to CLI with my admin account in all of nodes.

How can solve my problem ? Can admin account be expired ?

Thanks.

I've hit that a few times

Tim Steele — Mon, 21 Sep 2015 18:40:53 GMT

I've hit that a few times with customer implementations. One of the first things I do when putting a new deployment together is to add another CLI user with role admin. When customers call me with this issue, I can generally login with my second credential and reset the admin password.

And yes, the admin account will expire in keeping with your admin access password policies. You can see those in the GUI and on the CLI.

If you do not have a secondary account at the CLI like I mentioned above, you'll need to go through the password recovery process. Here is a URL that will help:

http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/installation_guide/ise_ig/ise_postins.html#pgfId-1189908

Tim

Thanks Tim , that's good idea

CansuTkr1 — Tue, 22 Sep 2015 08:29:53 GMT

Thanks Tim , that's good idea , I will cerate new admin account . We updated password and we found solution in https://supportforums.cisco.com/discussion/11686231/how-disable-ise-cli-password-expiration .

Good stuff, glad you have it

Tim Steele — Tue, 22 Sep 2015 17:05:30 GMT

Good stuff, glad you have it resolved. Just to clarify, both admin accounts will be subject to your password expiry rules. However, I have several customers who have admin account expiry disabled but the specific "admin" account became unusable. This is where the extra CLI account with the admin role really comes in handy. If you have to have password expiry rules in place, either create your extra account some days after your admin account or set a reminder to change your password so they don't expire at the same time. 🙂