When you do the initial ISE installation you create a username and password. This user becomes the primary super-user to access the ISE GUI. I used the same username for setup that we use to remotely login to all devices remotely currently. In setting up the device administration/TACACS portion of ISE, I am not able to select admin users as part of an authentication policy for device access. When I try to create a second user of the same name in an internal identity store I get an error saying that the user is a duplicate.
In testing I have an authentication policy that points to Internal Users, and created a temporary username in my internal identity store. When testing logging into a remote device pointed at ISE, I can login using my test username, but not my admin credentials. It appears my admin username does not fall underneath the umbrella of Internal Users, but I also do not see an option to specify an 'Admin Users' or the like in an authentication policy.
I am trying to avoid a mass username change for everyone who accesses these network devices, which is the outcome if I just create a new username and password to be used for everyone.
