topic Re: ISE TrustSec AAA Servers in Network Access Control

ISE TrustSec AAA Servers

bryan-tolka — Thu, 10 Jul 2025 16:52:07 GMT

Hello,

I have one AAA TrustSec server defined in ISE. However, when i try to remove it I get the error "Failed to delete AAA Server"

I am using TrustSec and i suspect this was used for testing. Anyone know how i can remove this server?

I think this also causes DNAC to provision CTS to switches when we we dont use it.

Re: ISE TrustSec AAA Servers

Torbjørn — Fri, 11 Jul 2025 10:17:45 GMT

Can you clarify a couple points:

You are trying to delete ISE from your DNAC and when you do you get "Failed to delete AAA server"
You don't intend to use TrustSec going forwards, and the current ISE deployment has only been used for testing?

Re: ISE TrustSec AAA Servers

MHM Cisco World — Fri, 11 Jul 2025 10:34:56 GMT

I am not so sure but

ISE not need to integration with external radius for trustSec

But it need for

DUO where ISE can use as radius proxy or MFA

MHM

Re: ISE TrustSec AAA Servers

wajidhassan — Fri, 11 Jul 2025 11:22:18 GMT

This issue usually happens when the AAA server is still referenced by another configuration object in ISE—most likely a TrustSec policy, SGT mapping, or even part of a live authorization profile. Even if it was used for testing, ISE won’t allow you to delete it until all dependencies are removed.

First, check if the server is tied to any:

Network Device Group settings
Access policies (especially under TrustSec or PxGrid configurations)
SGT/SGACL mappings or matrix entries
Active policy sets or rule conditions

Also, since you mentioned DNAC, ensure DNAC isn't automatically re-provisioning the server through a TrustSec template or pushing policies down to ISE. You might need to unsync the TrustSec configuration or remove the AAA server reference from DNAC templates before you can fully delete it from ISE.

If you’ve removed all references and still get the error, try restarting the ISE application services or check the ISE logs under Operations > Reports > System Diagnostics > Application Logs for detailed error traces. That might point to a hidden or stale dependency.