topic Re: Using ISE to authenticate a Juniper Switch in Network Access Control

Using ISE to authenticate a Juniper Switch

KMNRuser — Tue, 08 Apr 2025 13:36:01 GMT

Community,

We have a Juniper Core switch model qfx5100-48s-6q in our environment. All of our other switches are Cisco. We are currently rolling out ISE to use for TACACS+ authentication. Currently the Juniper is configured in Aruba Clearpass which we are replacing with the Cisco ISE. I am trying to determine if i can create a Juniper Device in ISE under Network Devices, and have it authenticate to ISE vs. Clearpass. Does anyone else have experience authenticating Juniper devices within Cisco ISE?

To me it looks like i could simply modify the commands already configured on the Juniper that allow it to talk to Aruba Clearpass, which are:

set system tacplus-server 192.168.1.163 port 49

set system tacplus-server 192.168.1.163 secret "XXXXXXXXXXXXXXXXXXX"

set system tacplus-server 192.168.1.163 single-connection

set system tacplus-server 192.168.1.163 source-address 10.1.0.3

Thank you,

KMNRUser

Re: Using ISE to authenticate a Juniper Switch

Mark Elsen — Tue, 08 Apr 2025 16:10:39 GMT

- FYI : https://www.juniper.net/documentation/us/en/software/nce/nce-213_ex_and_cisco_ise/topics/topic-map/nce-213-ex-series-switch-cisco-ise.html

Re: Using ISE to authenticate a Juniper Switch

Scott Fella — Tue, 08 Apr 2025 17:17:03 GMT

You can update that, just make sure to create the NAD in ISE using the Juniper profile. We have some older Juniper switches/routes that are using ISE as TACACS. I have attached the Juniper dictionary if you don't have that and the network device profile you will need to import if you also don't have that.

Re: Using ISE to authenticate a Juniper Switch

KMNRuser — Tue, 08 Apr 2025 17:01:39 GMT

Hi Scott,

Thanks for responding. When you have indicated that "you can update that"..what are you referencing that i can update? Thank you!

KMNRUser

Re: Using ISE to authenticate a Juniper Switch

Scott Fella — Tue, 08 Apr 2025 17:37:01 GMT

Update your switch/route config to point to ISE.

set system tacplus-server 192.168.1.163 port 49
set system tacplus-server 192.168.1.163 secret "XXXXXXXXXXXXXXXXXXX"
set system tacplus-server 192.168.1.163 single-connection
set system tacplus-server 192.168.1.163 source-address 10.1.0.3

Just make sure your "secret" is the same when you add the NAD to ISE.