ISE 2.7 with Dot1x and Tacacs+

[Desmond Lee]

Hi, I am need to implement Dot1X and use Tacacs+ at the same time with a single machine ISE (version 2.7).  
Dot1x may need Radius, so it is possible for ISE to act as both Radius and Tacacs+ server with the same IP address? (highlighted in red below)

Sample partial configuration of my switch:

aaa new-model

!

aaa authentication login default group tacacs+ local
aaa authentication enable default group tacacs+ enable
aaa authentication dot1x default group radius local  // or can I change the keyword "radius" to "tacacs+" instead ?

!

dot1x system-auth-control
dot1x critical eapol

!

tacacs-server host 10.10.10.1 key 7 xxxxxxxxxx
radius-server host 10.10.10.1 key 7 xxxxxxxxxx

Thanks !

Desmond

[Mike.Cifelli]

Yes it is possible for ISE to act as both a radius/tacacs server.  802.1x uses eapol and radius, see here for deeper dive: Wired 802.1X Deployment Guide - Cisco.

Make sure you enable your NAD in ISE to support both radius & tacacs (Administration->Network Resources->Network Devices). Keep in mind too that different licenses are needed for unique features (base lic for AAA, dot1x & Tacacs license which enables device admin feature).  Use this for additional guidance: ISE & NAC Community Resources - Cisco Community HTH!

[Desmond Lee]

configuration wise any error with the below ? thanks.

aaa new-model

!

aaa authentication login default group tacacs+ local
aaa authentication enable default group tacacs+ enable
aaa authentication dot1x default group radius local  // or can I change the keyword "radius" to "tacacs+" instead ?

!

dot1x system-auth-control
dot1x critical eapol

!

tacacs-server host 10.10.10.1 key 7 xxxxxxxxxx
radius-server host 10.10.10.1 key 7 xxxxxxxxxx

[Mike.Cifelli]

I recommend testing your config in a lab environment.  There is more to the deployment in regard to the dot1x config.  As mentioned earlier, dot1x uses radius so this statement would remain using radius:

aaa authentication dot1x default group radius local  // or can I change the keyword "radius" to "tacacs+" instead ?

HTH!