How to configure password policy on Cisco ISE 2.3 to manage the nodes

[djanhan.ndri]

Y’ello Cisco Team,

We are using Cisco ISE 2.3 to manage ours Network Nodes (Routers, Firewalls & Switchs).

When we are going to connect on the nodes we use our Active Directory Account.

We want to apply the password policy below on each account.

How you can help to do it ?

How we can apply it ?

 Password Policy:
- Idle time: 5 minutes
- Password failed attempts: 3
- Number of session per user: 1
- Accounts lockout duration (mn): 30

[Surendra · Accepted solution]

If you are talking about managing the ISE nodes, you can configure all of these under Administration > System > Admin Access.

- Idle time: Administration > System > Admin Access > Settings > Session.
- Password failed attempts: Administration > System > Admin Access > Authentication > Lock/Suspend Settings
- Number of session per user: Though you cannot restrict this on per user basis, you limit the concurrent sessions at Administration > System > Admin Access > Settings > Access > Session
- Accounts lockout duration: Administration > System > Admin Access > Authentication > Lock/Suspend Settings.

If you are talking about managing the network devices, then you will have to configure them on those individual devices.

[Damien Miller]

If the intention is to use Active directory accounts with ISE for device administration, TACACS and RADIUS, then the password policy would be managed by AD. The accounts will exist in AD and it will follow the password policy configured for the domain.

Surendra covered where you would handle this locally in ISE. I think we need clarification on the intent.