Cisco ISE password reset

[jimmy100]

I am wanting to reset the ISE GUI admin password via the ISO. We have 2 ISE in HA failover (Pri/Sec)

My question is, can I power off the Secondary & change the GUI admin password there whilst the Primary is still running. Or do I have to power them both off?

NOTE: I am also UNABLE to log on to the CLI admin account.

[balaji.bandi]

there is small downtime required for the ISE to go offline to reset password. - suggest to do the password change on Primary.

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/200568-ISE-Password-Recovery-Mechanisms.html

[Rob Ingram]

@jimmy100 you can power off the secondary ISE node without experiencing an outage for authenticating sessions assuming the Primary node is also configured as a PSN and the network devices (switches, WLC etc) are configured to use both ISE nodes for AAA.

[jimmy100]

Hi Rob,

Will the secondary appliance then propagate the new password over to the primary when it is booted back up?

[Greg Gibbs]

No. Neither the CLI nor the GUI admin passwords are synchronized across nodes in a cluster. They need to be managed on each individual node.