topic Re: How to change a secondary node GUI admin password using CLI in Network Access Control

How to change a secondary node GUI admin password using CLI

behzad bayat — Sat, 04 Nov 2023 06:55:31 GMT

I have a Cisco ISE cluster. The primary node is no longer available, and I cannot access the GUI for the secondary node because the password has expired. However, I have access to the CLI for the secondary node. How can I change the password policy for the secondary node? I've attempted this but it didn't allow me to proceed and instead prompted me to do this via the primary node, which is no longer available. I tried to change the password via "application reset-passwd ise admin," but it didn't allow me to do so.

How can I change the GUI password for the secondary node when the primary node is no longer available?

TNX

Re: How to change a secondary node GUI admin password using CLI

Blue_Bird — Sat, 04 Nov 2023 08:30:35 GMT

In Cisco ISE the WebGUI and CLI admin accounts/passwords are separate. In order to change the passwords you can use the following methods:

The CLI Admin password can be changed from the CLI by entering the command password. The CLI password is unique to each ISE node

The WebGUI password can be changed from the CLI by entering the command application reset-passwd ise admin. The WebGUI password must be reset on the Primary PAN, this password is then synchronised to all ISE nodes.
Alternatively you can reset the WebGUI (not CLI) password within the WebGUI itself. Navigate to Administration > System > Admin Access > Administrators > Admin Users

Best regards
******* If This Helps, Please Rate *******

Re: How to change a secondary node GUI admin password using CLI

thomas — Mon, 06 Nov 2023 23:45:12 GMT

aIf you cannot reset the ISE admin password without the PAN which you do not have then the only other option is to make this node a Standalone node with application reset-config ise. However, before doing that, you should just rebuild your original ISE PAN - hopefully you have a backup! - then re-join the Secondary and PSNs to your new Primary.

You may want to call TAC and see if they have any additional tricks but I suspect you have really backed yourself into a corner without any alternate or unexpired administrator logins.