topic Re: CISCO ISE in Network Access Control

CISCO ISE

Nick O — Mon, 28 Aug 2023 15:03:03 GMT

I have a ISE server that is unable to communicate with my switch stack. I have tied in my ISE server on the switch already below is my config.

aaa authentication login VTY group ise-servers local
aaa authentication enable default group ise-servers enable
aaa authorization exec VTY group ise-servers local
aaa authorization config-commands
aaa authorization console
aaa accounting exec default start-stop group ise-servers
aaa accounting commands 0 default start-stop group ise-servers
aaa accounting commands 1 default stop-only group ise-servers
aaa accounting commands 7 default stop-only group ise-servers
aaa accounting commands 15 default stop-only group ise-servers
aaa accounting system default start-stop group ise-servers

I have tested my user created on my ISE gui using the test aaa group ise-servers username password which came back successful but when i try to log in through ssh it is blocked. also when I open another ssh session to log in with local credentials on the switch it errors out saying Error in Authentication.

Re: CISCO ISE

Rob Ingram — Mon, 28 Aug 2023 15:09:14 GMT

@Nick O as you've defined the method list called VTY have you configured the VTY lines to use this method list? If not it will not use ISE for AAA.

Re: CISCO ISE

Nick O — Mon, 28 Aug 2023 15:14:56 GMT

line vty 0 4
exec-timeout 30 0
password 7 070C285F4D0659
logging synchronous
login authentication ise-servers
transport input ssh

this is the config I have right now

Re: CISCO ISE

Rob Ingram — Mon, 28 Aug 2023 15:25:54 GMT

@Nick O your method list is VTY, that should be referenced under the VTY line configuration

line vty 0 4
 login authentication VTY

Guide for reference - https://community.cisco.com/t5/security-knowledge-base/cisco-ise-device-administration-prescriptive-deployment-guide/ta-p/3738365