ISE ERS Network Device API / PUT (update) operation: How to remove RADIUS authentication?

[Johannes Luther]

Hi board,

I'm having this network device in my ISE 2.4 patch 11 deployment:

#

{
  "NetworkDevice": {
    "id": "aa874f10-497f-11ea-8848-0050568b5bee",
    "name": "myDevice1",
    "description": "new description",
    "authenticationSettings": {
      "networkProtocol": "RADIUS",
      "radiusSharedSecret": "SuperSecret",
      "enableKeyWrap": false,
      "dtlsRequired": false,
      "keyEncryptionKey": "",
      "messageAuthenticatorCodeKey": "",
      "keyInputFormat": "ASCII",
      "enableMultiSecret": "false"
    },
    "profileName": "Cisco",
    "coaPort": 0,
    "NetworkDeviceIPList": [
      {
        "ipaddress": "192.0.2.1",
        "mask": 32
      }
    ],
    "NetworkDeviceGroupList": [
      "Location#All Locations",
      "Device Type#All Device Types",
      "IPSEC#Is IPSEC Device"
    ]
  }
}

So in this example, the network device is configured for RADIUS. In the ISE the "RADIUS authentication settings" are enabled.

How do I remove the "RADIUS authentication settings" from the network device using the API (so remove RADIUS support)?

I tried the following:

• PUT body: Send the whole JSON data, excluding the "authenticationSettings" key (section).
  ==> HTTP 200: No values were updated ({'UpdatedFieldsList': {'updatedField': []}})
• PUT body: Send the whole JSON data, and setting of the "enabled" attribute in the "authenticationSettings". The "enabled" attribute is outlined in the ERS API documentation, but I never saw it in real life :)
  "authenticationSettings": {"enabled": false}
  ==> HTTP 400: Invalid JSON: Unrecognized field \"enabled\"
• PUT body: Empty authenticationSettings ("authenticationSettings": {})
  ==> HTTP 200: No values were updated ({'UpdatedFieldsList': {'updatedField': []}})

So anybody know, how to get rid of the "authenticationSettings" using the ERS API?

[Greg Gibbs · Accepted solution]

According to the Resource Definition documented in DevNet, the 'authenticationSettings' attribute is not a boolean value, therefore there does not appear to be an option for a true/false value.

Even when I create a new NAD via the API with the 'authenticationSettings' section removed, the output from a Get-by-id call still includes basic values for that section:

<authenticationSettings>
<dtlsRequired>false</dtlsRequired>
<enableKeyWrap>false</enableKeyWrap>
<enableMultiSecret>false</enableMultiSecret>
</authenticationSettings>

I suspect the only way to disable the RADIUS settings via API after they have been configured would be to Delete and re-create the NAD. For a definitive answer, you would likely have to open a TAC case to get confirmation from the development engineers.

Cheers,

Greg