ISE Device Administration (TACACS+)

[Caijones17]

Hi,

I have imported multiple network devices to ISE 2.4 and I was wondering if there was a way to add TACACS authentication and shared secret to multiple devices at once. I can add them individually but since I have a large number of network devices it will be tedious. There seems to be a bug when trying to import a .csv and choosing any protocol apart from RADIUS.

Cheers.

[Aravind Ravichandran]

Hi,

You can try Rest API to add the network devices to ISE.

POST https://ISE-IP:9060/ers/config/networkdevice

-Aravind

[Mohammed al Baqari]

I was going to suggest import but since you said a bug the only method left
is using a script (such as python) to connect to ISE ERS, read the data
from your csv, format it as json and create the devices. This is pretty
fast and will do the trick. ISE has an API for network devices.

[Nadav · Accepted solution]

Hi,

I can attest that for ISE 2.4 P4 I've been able to import both TACACS+ and RADIUS endpoints, so if you are having issues with it you may want to try importing just one device and see why it's having issues. 

[Damien Miller]

Also confirm, no issues here. 

[Caijones17]

• "1) test Failed Illegal value TACACS for Protocol"

This is the output I receive. My next step is to use the API but I thought I would try here first, any help is appreciated.

Thanks.

[Nadav · Accepted solution]

That's because Protocol is for RADIUS, not TACACS+. If you want that device to have RADIUS, add RADIUS under Protocol.

For TACACS+ you have different fields to populate, such as Shared Secret and Connect Mode Options.

Honestly, it would be easiest to create a single device for TACACS+ in your ISE, export to CSV from the GUI, and use that as a template. 

[Caijones17]

Sorted, thanks.

[Nadav]

That's because if you add Protocol, it's mandatory. If you are only adding TACACS+ without RADIUS, you won't even have a Protocol field to begin with.

I strongly suggest you make a network device or two only for TACACS+ directly in ISE, then export those two. Use that as a template.