topic Re: Using TACACS+ / RAIDUS for ISE CLI login in Network Access Control

Using TACACS+ / RAIDUS for ISE CLI login

SMD28316 — Thu, 26 May 2022 12:21:41 GMT

So on the ISE CLI I found the option to enable TACACS+:

ise/admin(config)# aaa authentication tacacs+ server ?
<WORD> Server ip or hostname (Max Size - 31)

ise/admin(config)# aaa authentication tacacs+ server

Can I use TACACS+ for CLI login? I didn't find a useful document for this commnad, also can I use RADIUS instead? if not I would like to know if there are plans to enable it in the future,

Re: Using TACACS+ / RAIDUS for ISE CLI login

Meddane — Thu, 26 May 2022 16:21:22 GMT

@SMD28316 since ISE 2.6 version, the CLI Access to ISE by External Identity Store is added.

ISE supports authentication of CLI administrators by external identity sources, such as Active Directory.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/release_notes/b_ise_26_RN.html#id_97053

It is better to use TACACS to control CLI access rather than RADIUS. This is because simply RADIUS does not separate authentication and authorization while TACACS does, in other words RADIUS cannot manage per command CLI authorization.

Re: Using TACACS+ / RAIDUS for ISE CLI login

Arne Bier — Fri, 27 May 2022 05:41:16 GMT

@SMD28316 - RADIUS is a valid option for Device Admin in my opinion, if you don't need all that fancy command auth and command accounting that TACACS+ offers. It works great.

Use the following RADIUS Authentication logic (notice the RADIUS Attributes used in each case)

As for the results, you return the usual priv level 15 (or whatever you need) in the Cisco AV Pair - might have to google that - I don't have a copy of what I used back in the day

Re: Using TACACS+ / RAIDUS for ISE CLI login

SMD28316 — Fri, 27 May 2022 07:23:16 GMT

Thank you,

yes I understand this, but can I use RADIUS for ISE CLI authentication? it doesn't seem available for now.

Re: Using TACACS+ / RAIDUS for ISE CLI login

ahollifield — Fri, 27 May 2022 12:25:32 GMT

That is correct. Local CLI admin user or Active Directory only.