ISE CLI Connection Problem

[CansuTkr1]

Hi ,

We use ISE version 1.2 and I have two admin , 2 monitoring and 8 psn node . Now I can't login to CLI with my admin account in all of nodes.

How can solve my problem ? Can admin account be expired ?

Thanks.

[Tim Steele]

I've hit that a few times with customer implementations.  One of the first things I do when putting a new deployment together is to add another CLI user with role admin.  When customers call me with this issue, I can generally login with my second credential and reset the admin password.

And yes, the admin account will expire in keeping with your admin access password policies.  You can see those in the GUI and on the CLI. 

If you do not have a secondary account at the CLI like I mentioned above, you'll need to go through the password recovery process.  Here is a URL that will help:

http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/installation_guide/ise_ig/ise_postins.html#pgfId-1189908

Tim

[CansuTkr1]

Thanks Tim , that's good idea , I will cerate new admin account  . We updated password and we found solution in https://supportforums.cisco.com/discussion/11686231/how-disable-ise-cli-password-expiration .

[Tim Steele]

Good stuff, glad you have it resolved.  Just to clarify, both admin accounts will be subject to your password expiry rules.  However, I have several customers who have admin account expiry disabled but the specific "admin" account became unusable.  This is where the extra CLI account with the admin role really comes in handy.  If you have to have password expiry rules in place, either create your extra account some days after your admin account or set a reminder to change your password so they don't expire at the same time.  :)