08-28-2019 09:47 AM
We recently set up a secondary ISE server today. The install completed and everything rebooted fine. However, when I go to log into the Web GUI the system will not accept the Admin creds we created during the initial set up. The odd thing is if I go to the command line and use the same creds, they work fine?
What am I missing?
Solved! Go to Solution.
08-28-2019 09:02 PM
The CLI admin login is a separate account to the username used for the GUI login. it's just a happy coincidence that after you install ISE and run the wizard, choose admin/password123 in the wizard, that ISE also creates a GUI account called admin and sets the password as password123. The distinction is not made obvious at the time of install.
Most folks leave the CLI admin as is, and then either disable the GUI admin account or use AD instead. You can also create loads of additional GUI admin accounts.
As Damien pointed out, the application-password (aka "GUI password") can be reset via the CLI - but not vice-versa. If you lock yourself out of the CLI and no way in (but still have GUI access), then you have no choice but to reboot the appliance using the installation .iso and perform a password recovery.
In ISE 2.6 there is a new feature to allow AD accounts to be used to log into the CLI.
08-28-2019 10:25 AM
08-28-2019 10:32 AM
Damien,
Thanks for a quick reply..
We created a custom user name, so I need to use that for the reset command I know..
It has not been joined to the primary server yet as we usually do it thru the Web GUI.
Again the odd thing is if I go to the command line interface, I can sign into that with the current credentials fine with no issue, so wouldn't that make me believe that they should work at the Web GUI as well?
This is my confusion....
08-28-2019 12:56 PM
08-28-2019 09:02 PM
The CLI admin login is a separate account to the username used for the GUI login. it's just a happy coincidence that after you install ISE and run the wizard, choose admin/password123 in the wizard, that ISE also creates a GUI account called admin and sets the password as password123. The distinction is not made obvious at the time of install.
Most folks leave the CLI admin as is, and then either disable the GUI admin account or use AD instead. You can also create loads of additional GUI admin accounts.
As Damien pointed out, the application-password (aka "GUI password") can be reset via the CLI - but not vice-versa. If you lock yourself out of the CLI and no way in (but still have GUI access), then you have no choice but to reboot the appliance using the installation .iso and perform a password recovery.
In ISE 2.6 there is a new feature to allow AD accounts to be used to log into the CLI.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide