ISE 2.6 CLI Access through External Identity Store

[JP_Berlin]

Hi community,

I want to configure my AD as an external identity source for ISE CLI access. The only documentation I've found so far is this:

https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/admin_guide/b_ise_admin_guide_26/b_ise_admin_guide_26_chapter_0101.html#id_99029

Maybe it's just me but in my opinion it doesn't cut it. Can anyone point me to a more comprehensive documentation? If it does not exist, I think we should create it!

Thanks,

Jonathan

[Colby LeMaire · Accepted solution]

Within Active Directory, you can edit attributes for a particular user account.  The documentation is saying to modify the "gidNumber" and "uidNumber" attributes in Active Directory for the account you want to use as the CLI Admin User.  ISE will read those attributes to ensure the user is authorized to be a CLI Admin.  These attributes are not used by Active Directory and are not set by default.  So you can find your user within AD and go to Properties.  Then select "Attribute Editor" to see/edit attributes.  If you don't see the "Attribute Editor" tab, then you need to go to View and select the option for "Advanced".  Then open Properties again and it will be there.  Following are screenshots showing you the default settings for a user in AD for "gidNumber" and "uidNumber":

[JP_Berlin]

Super helpful, thanks a lot for this description! I have it now running in my lab...

[hslai]

Colby.LeMaire is correct.

Attached is the section of our ISE 2.6 Update lab guide on this feature.

I also opened a doc bug to ask the admin and cli guides updated. CSCvs37998

[JP_Berlin]

Thanks a lot for opening the defect. I really appreciate the effort by Product Management on this forum 👍🏻

Some feedback on the feature: I like it and I could make it run in a couple of minutes with this descriptive guide. I just hope we can avoid to rejoin the ISE node from the GUI in the future..

[Sp@wn]

Hello @hslai ,

Is it not necessary to create any tacacs + rules on the ISE using the "gidNumber" and "uidNumber" parameters configured on the Active Directory side, except for active directory integration from the command line?

[hslai]

Sp@wn ISE CLI Admin access is NOT using ISE T+ so no relationships to ISE T+ rules. I am guessing you are thinking about the admin CLI of Cisco PI, which allows T+.

[Sp@wn]

I am trying to understand how ISE decide the user is a CLI admin with full administrative role privilege or CLI user with read-only role privileges. where is the ISE uses these uidNumber and gidNumber values?

[matthew.shelley]

From https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/admin_guide/b_ise_admin_guide_26/b_ise_admin_guide_26_chapter_0101.html#id_99029

• Assign gidNumber as 110 or 111.

• GidNumber 110 denotes an admin user whereas 111 denotes a read-only user.

[Sp@wn]

I am trying to understand the configuration made on ISE side for the CLI Access through External Identity Store. I read the document you shared. I did not see a configuration example related with GidNumber on the ISE side, but I encountered the following contradictory statement.

Administrators who belong to a Super Admin group, and are configured to authenticate and authorize using an external identity store, can also authenticate with the external identity store for CLI access.

Note	You can configure this method of providing external administrator authentication only via the Admin portal. The Cisco ISE Command Line Interface (CLI) does not feature these functions.