9300L switch to use configured ENABLE password within ISE per user

[Ced W]

Hi,
I am migrating from ACS/TACACS+ deployment, to ISE/RADIUS deployment.
I am able to get the switches to roger up with ISE/RADIUS deployment but I am unable to move into Priv EXEC mode unless I am consoled in. When I try to SSH with IP address, I get "% Error in Authentication" or if I configure a secret password, all users would have to use that same secret password.

How do I setup ISE/Radius deployment to use individual user set enable password on the ISE server when logging into the switch ...?

I have looked at other threads but none help my situation and currently looking, Cisco TAC was unable to assist.
But I am about to poor over this guide: https://www.cisco.com/c/en/us/td/docs/security/ise/3-3/admin_guide/b_ise_admin_3_3/b_ISE_admin_33_device_admin.html#concept_9B1DD5A7AD9C445AAC764722E6E7D32A

AAA config below

TestBench#sh run aaa
!
aaa authentication login default group ISE local enable
aaa authorization exec default group ISE if-authenticated
aaa authorization console
aaa accounting connection default start-stop group ISE
aaa accounting system default start-stop group ISE
username actual privilege 15 secret 9
!
radius server ISE01
address ipv4 auth-port 1812 acct-port 1813
key 7
!
radius server ISE02
address ipv4 auth-port 1812 acct-port 1813
key 7
!
aaa group server radius ISE
server name ISE01
server name ISE02
!
aaa new-model
aaa session-id common
!
ip radius source-interface Vlan6192847

[ccieexpert]

you need something like this:

aaa authentication enable default group ISE local

[Ced W]

@ccieexpert,

That specific line of code is not available on this 9300L 48 PoE+ 4x10G switch, but I did try a variation, "aaa authentication login default group ISE local enable", but this did not help either. I am afraid to take remove the "enable secret password" line and try for fear of getting locked out and having to backdoor the switch again.
Thank you.

[ccieexpert]

that wont help with enable.

https://community.cisco.com/t5/security-knowledge-base/cisco-ise-device-administration-prescriptive-deployment-guide/ta-p/3738365

aaa authentication enable default group ISE enable  ... please paste your current config..

[Ced W]

@ccieexpert 

here are the configs, not sure which config you are asking for....
I am looking through the guide, thank you.

[Flavio Miranda]

@Ced W 

 You line vty is configured?

line vty 0 4
 transport input ssh
 login local
line vty 5 15
 transport input ssh
 login local

You should have this lines

aaa authentication enable default group ISE  enable

aaa authorization exec default group ISE   local

 

[Ced W]

@Flavio Miranda 
I have tried "login local" but that option is not available for this 9300L 48 PoE+ 4x10G switch
I did try the following variations, "login authentication ISE", in which i got this error, "AAA: Warning authentication list "ISE" is not defined for LOGIN." and doing research on this.

I also tried "login authentication default", to no avail.

Thank you.

[Flavio Miranda]

@Ced W 

 You should have "login local" under line vty

do you have "aaa new-model"  command?

[Ced W]

@Flavio Miranda 
I have "authorization exec default", I will try "login local"
Yes, I do have "aaa new-model" command.

***EDIT
"login local" is not an available command.

TestBench(config-line)#login ?
authentication Authentication parameters.

TestBench(config-line)#login auth
TestBench(config-line)#login authentication ?
WORD Use an authentication list with this name.
default Use the default authentication list.

TestBench(config-line)#login authentication d
TestBench(config-line)#login authentication default ?
<cr> <cr>

TestBench(config-line)#login authentication default

[Ced W]

@Flavio Miranda 
I added the suggested line and now I get

aaa authentication enable default group ISE  enable

instead of "wrong/bad password"
Glad I didn't "wr" or else I would have to back door the switch to recover password

[MHM Cisco World]

I will send you PM tomorrow 

MHM

[PSM]

@Ced W just wondering why you want to use Radius instead of Tacacs for device authentications ? Tacacs is much better for this use instead of Radius. 

Anyhow can you try config like this. Don't define anything under line VTY, and it should pick default method.

aaa authentication login default group ISE local
aaa authorization exec default group ISE local

[Ced W]

@PSM 
I tried TACACS+ but could not figure it out, it was much easier for me to get up and running on RADIUS. But if you can help me setup TACACS+ properly, I would love to do that instead.

This is what I have on my vty line 0 1, should i remove the bold and underlined items ...? Thank you

TestBench#sh run all | b line vty 0 1
line vty 0 1
session-timeout 2
access-class MANAGEMENT_NET in
motd-banner
exec-banner
exec-timeout 10 0
timeout login response 30
privilege level 1
authorization exec default
accounting exec default
logging synchronous
login authentication default
data-character-bits 8
exec-character-bits 7
special-character-bits 7
domain-lookup
exec
length 24
width 80
history size 10
history
editing
monitor
transport input ssh
escape-character soft DEFAULT
escape-character DEFAULT
start-character 17
stop-character 19

[Ced W]

@PSM 
I have tried the lines you recommended, it still only allows me to login with the configured enable password on the switch and not the pre-configured enable password in ISE, see photo...

[PSM]

@Ced W please remove "privilege level 1" from line vty and then test.