CSCwn09816 - RADIUS Shared Secret Masking

[Tamas Demeter]

Hi,

we have version 3.3.0.430 with patch 3,4,6,7 installed and we are hitting this bug still.

The known fixed version is 3.3.0.430 patch 5. Won't patch 6 and 7 contain the fix from patch 5?

Additionally: we are hitting this when modifying a device on the Administration -> Network devices page (for example adding a new IP will change the Radius password to ******** ) I can easily reproduce this with a test device.

[Mark Elsen]

 @Network Diver  No worries here pal , I am married (LOL!)

 M.

[adn25]

[Network Diver]

Reply from Cisco TAC: There is a new bug that matches this behaviour: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwp06928 

[Tamas Demeter]

Indeed, I opened a TAC case and they released a new patch for 3.4 (patch 4) - and it seem to have fixed the issue in our Lab.

The patch for 3.3 will be released at the end of the month, I'm looking forward to patch our Production and test it.

[jeaves@cisco.com · Accepted solution]

Sorry for all the confusion. ISE patches are always cumulative.

CSCwn09816 (RADIUS Shared Secret Masking After Switch Reload Causes Authentication Failures) led the ISE team to add a pop-up message when 'Show Password in Plaintext' option is unchecked.

That pop-up message includes the following text when 'Show Password in Plaintext' option is unchecked: "Disabling this option hides the Show button for Network Device RADIUS shared secrets and IPsec pre-shared keys. The RADIUS shared secret will remain hidden when accessing network devices using the ERS API and during their export. The IPsec pre-shared key will also remain hidden when accessed using Open API. If Cisco ISE is integrated with Cisco Catalyst Center, do not disable this option. Disabling it will lead to incorrect configuration of RADIUS shared secret keys for network devices."

The actual fix for the issue is within Catalyst Center. That DDTS entry is CSCwn51980 (DNAC to Use PATCH operation instead of PUT), documented integrated releases are 2.3.7.10, 3.1.5 and 3.2.1.

Until the permanent fix is implemented, a workaround to recover the password is to manually re-enter the shared secret on ISE and enable the "Show Password in Plaintext" option.

[Gaetan Longree]

---

jeaves@cisco.com wrote:
[...] The actual fix for the issue is within Catalyst Center.

This is a bit of a misleading statement - even without integration in Catalyst Center, the issue can occur. The root cause of the behavior is still within the ISE GUI/API handling, not within Catalyst Center.

[Tamas Demeter]

By permanent fix do you mean a patch for Cisco ISE? We really don't want to wait for a patch in Catalyst Center, as we are not using it at all.