ISE AAA Tacacs+ and Wired RADIUS 802.1X (NAC) not functional

[Ferdaush]

I have configured a new Cisco Access switch (C9300-48U, CAT9K_IOSXE, SW Version- 17.03.03) for Device admin access "ISE AAA TACACS+" and ISE NAC Solution for Wired 802.1x. I did all the basic configuration and Wired 802.1x configuration as other switches. But while I was trying to login to the switch, it only accepted the Switch Local user and password and didn't ask for or accept Device ADMIN credentials.

Also, the Wired NAC solution is not functional.

Please find the Applied Basic Config and AAA config in the attachment.

Your kind support is highly appreciated. 

[ahollifield]

https://www.ise-support.com/cisco-ise-nad-configuration-templates/

https://community.cisco.com/t5/security-documents/how-to-ask-the-community-for-help/ta-p/3704356

[balaji.bandi]

Device access working in Cat 9300 example :

aaa new-model
!
!
tacacs server ISE01
address ipv4 192.x.x.1
key 7 xxxxxxxxxxxx
tacacs server ISE02
address ipv4 192.x.x.2
key 7 xxxxxxxxxxxx
!
aaa group server tacacs+ MY_ISE
server name ISE01
server name ISE02
!
aaa authentication login default group MY_ISE local
aaa authorization config-commands
aaa authorization exec default group MY_ISE local
aaa authorization commands 0 default group MY_ISE local
aaa authorization commands 1 default group MY_ISE local
aaa authorization commands 15 default group MY_ISE local
!

One step at a time - test device admin working ok - then 802.1x

Look at ISE 802.1x wired deployment guide :

https://community.cisco.com/t5/security-knowledge-base/ise-secure-wired-access-prescriptive-deployment-guide/ta-p/3641515

[hslai]

@Ferdaush I agreed with the other responses. 

Also take a look at Cisco ISE Device Administration Prescriptive Deployment Guide / Cisco IOS – Switches/Routers

[Ferdaush · Accepted solution]

Thanks everyone for your valuable suggestions. I have solved the issue by adding a Default Gateway in the Access switch.