Enable password for local user/administrator

[pnavratil]

Hi all,

we are using ISE 2.1 with device admin license (TACACS).

Now we found it is not possible to setup enable password for user, which are setup as local ISE administrators - as I cannot edit user attributes in Identity Management -> Identities -> <User> page and in System -> Admin Access -> Administrators -> Admin Users -> <User> it is not possible to setup enable password.

It looks it is not possible to use local administrator as TACACS user in this way.

Does anybody met the same problem?

Regards

Pavel

[Rajat Gupta]

Hello Pavel,

You won't be able to use an ISE Admin user to login to your Network Devices (using TACACS or RADIUS). These users are in a different database.

You will need to create separate users under the Device Administration to use them for NAD device logins. 
Please let me know if you have any other questions/concerns regarding this.

Regards,
Rj

[pnavratil]

Hello Rajat,

it is IMHO the same database if you create the ISE Admin user from existing Network User (the way Administration -> Admin Access  -> Administrators -> Admin Users -> <Add> -> Select from Network Access Users).

In this way I can still use this user or his local groups in TACACS os RADIUS rules and it works - I can use such user to connect to network devices by for instance SSH authenticated by TACACS, the only thing I cannot use is enable password (needed in case the privilege level is not setup by TACACS profile) - I even try to setup enable password on local user and then create local admin from him - still the enable password is cleared.

If it is feature by design to not allow to use enable password for such ISE admin users - I expect the forms for setting enable password would be greyed out or something like this but it is not. You can setup enable password - save it - the ISE reports to you the save was succesful but when you reopen the user you will find the enable password is not set.

Regards

P