ACS to ISE 2.7 migration. TACAC+ enable login issue

[marce1000]

                               - What is the issue ?

 M.

[KelvinT]

Wow!  It didn't take my questions.

Basically in ISE the user successfully login the 1st part but when the switch ask for enable password it fails.  Authc failure.

FYI when pointing the switch to the ACS it works without issue.

Thanks

[marce1000]

  - What's in the ISE logs when this happens ?

 M.

[KelvinT]

The initial log on shows authz successful.  the enable login attempt shows authc failure.  bad credential.

[marce1000]

 - Verify your ISE policies and setup according to this document :

          https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/200208-Configure-ISE-2-0-IOS-TACACS-Authentic.html

 M.

[KelvinT]

Yes it is with some exceptions.

We check the box for maximum privilege 15.  Is there a reason it isn't selected?

[marce1000]

                                - You mean you can't check the box ?

 M.

[KelvinT]

No.  Its checked.  We are running ISE 2.7 patch2. I thought that was required for enabled mode.

[marce1000]

 - The original document I referred to also contains :

              Note: For TACACS you need to have separate license installed

                                      Check this thread for further info's on that :

         https://community.cisco.com/t5/network-access-control/tacacs-licenses-in-ise/m-p/3504911

 M.

[KelvinT]

Yes.  Licenses are there and consumed.

[marce1000 · Accepted solution]

 -  https://community.cisco.com/t5/security-documents/cisco-ise-device-administration-prescriptive-deployment-guide/ta-p/3738365#toc-hId--919282975

         Follow the referenced example, to create  a user or user(s) with enable(d) privilege(s) directly. If problems persist on the logging for the failed authentication click on detail. Check which policy rules were matched and or check correctness of the policy (sets)

 M.

[KelvinT · Accepted solution]

I found the issue.

An ISE configuration that migrated over from 2 previous upgrades using the 1st old ACS to new ACS IOS then from new ACS to ISE.  The configuration was a shell:roles"network-admin" that was on the profile.  The debug showed it failing with ACS but ACS just ignored it and authc the user.  ISE doesn't ignore it.  It gives an authc failure.

After removing the av-pair from the shell profile the user authc successfully.

Thanks for your help.