Can't Log Into ISE Web GUI

[Joe Della Valle]

We recently set up a secondary ISE server today. The install completed and everything rebooted fine. However, when I go to log into the Web GUI the system will not accept the Admin creds we created during the initial set up. The odd thing is if I go to the command line and use the same creds, they work fine? 

What am I missing?

[Damien Miller]

It might be locked out now for what its worth. If you joined it to the deployment, then the GUI admin account would be the same as the primary node (shared).

You can reset the GUI admin account password from the CLI, if you used the default admin during set up then you will use this command.
"application reset-passwd ise admin"

[Joe Della Valle]

Damien,

Thanks for a quick reply..

We created a custom user name, so I need to use that for the reset command I know..

It has not been joined to the primary server yet as we usually do it thru the Web GUI.

Again the odd thing is if I go to the command line interface, I can sign into that with the current credentials fine with no issue, so wouldn't that make me believe that they should work at the Web GUI as well?

This is my confusion....

[Jason Kunst]

If still having issues work with the TAC as well

[Arne Bier · Accepted solution]

Hi @Joe Della Valle 

The CLI admin login is a separate account to the username used for the GUI login.  it's just a happy coincidence that after you install ISE and run the wizard, choose admin/password123 in the wizard, that ISE also creates a GUI account called admin and sets the password as password123.  The distinction is not made obvious at the time of install.

Most folks leave the CLI admin as is, and then either disable the GUI admin account or use AD instead.  You can also create loads of additional GUI admin accounts.  

As Damien pointed out, the application-password (aka "GUI password") can be reset via the CLI - but not vice-versa.  If you lock yourself out of the CLI and no way in (but still have GUI access), then you have no choice but to reboot the appliance using the installation .iso and perform a password recovery.

In ISE 2.6 there is a new feature to allow AD accounts to be used to log into the CLI.