AAA ISE 2.3 - FIPS Compliance & Default Device Admin Allowed Protocols

[Renzo_Orezzoli]

I upgraded a SNS-3415-K9 to ISE 2.3 and I'm trying to enable FIPS but I can't because only the "Default Device Admin" is allowed in policy.

I tried deleting the Migrated_Default Device Admin but I get: "Error: This object is referenced by Rule-2,"

If I disable the "migrated default device admin allowed protocols none of my devices (IE3k, IE4k, 2960, 3750, c6500) authenticate. This does allow FIPS to be enabled though.

I've tried reading manuals, but I can't figure it out.

[Renzo_Orezzoli]

I figured it out.

Under: Work Centers > Device Administration > Device Admin Policy Sets > Rule-2

I changed the "allowed Protocols/server sequence-

TO: "Default Device Admin"

FROM:"Migrated_Default Device Admin"

This allowed me to delete the migrated Allowed Protocols Services group.

I now only allow PAP/ASCII via the default device admin & FIPS is applied. I tested this on ISE2 (secondary) prior to changing ISE1 (primary) [for clarity, they are both in primary mode - the devices see ISE1 first].

Hope this helps someone in the future.