ISE Enabled Client Certificate Based and now Locked out of webgui

[Jmf7]

Hello,

Newbs here. Just got 2 new ISE running v2.4. We enabled Client Certificate Based under authentication > admin access. We failed and now cannot login through the web gui to change back to password based. We do have access to cli via ssh.

1. Is there a way to change back to password based over cli?

2. If not, what are our options to restore access to the web interface? I seen a reset-config command, but wanted to see if anyone had any other suggestions.

Thanks!

[Mohammed al Baqari]

I don't think there is another way of doing this.

[Damien Miller]

TAC maybe be able to correct this via root. But that's still a maybe since I've not had personal experience with it.

Certainly can't hurt opening up a case.

[Jmf7 · Accepted solution]

For anyone that comes across this post, restarting the ISE service in safe mode bypasses the Certificate authentication. It will prompt, but select cancel and you will be able to login with the admin account.

Commands:

1. Login via cli or ssh with admin

2. Run application stop ise. Wait for the service to stop.

3. Run application start ise safe. Attempt to login to the web interface.

4. Select cancel on the certificate prompt. Login as normal with admin.

5. Don't forget to stop/start the ise service again to take it out of safe mode once changes are complete.

Hope this helps someone else!