Read only acceess Account creation on ISE

[wajid_dabir]

Hi Team,

As per my network team, we can't create a read only account in ISE server to access all registered node? Is it true?

[agapitca19]

wajid_dabir,

Try this.

Administration>System>Admin Access>Administrators>Admin Groups>If it's an External Group like Active Directory, click the "+" sign, select the AD security group of the users OR if it's internal users, under Member Users add the user.

In Administration>System>Admin Access>Authentication>Identity Source:Select your choice(AD Group or Internal)

Authorization>Permissions>Menu Access>Click the checkbox of Menu Access that's closest to your requirement for read access>Select Duplicate>Rename the duplicate OR you may duplicate a Menu Access that has a higher level of Menu Access>Rename the duplicate>Click the renamed Menu Access>Edit it which are to be shown and hidden.

Authorization>Permissions>Data Access>Click the checkbox of Data Access that's closest to your requirement for read access>Select Duplicate>Rename the duplicate OR you may duplicate a Data Access that has a higher level of Data Access>Rename the duplicate>Click the renamed Data Access>Edit it which are to be shown and hidden.

Authorization>Permissions>Policy>Click Actions of any Rule Name>Duplicate>Rename the duplicate>If=click the "+" sign, select the user group(Internal or AD)>then=click the "+" sign, select the Menu and Data Access that you have created above>Save>Test it.

HTH.

***Please rate and mark the comment correct if you find it helpful.Thanks***

[Steven Williams]

does this work? I have read there is no read only account that can be done with ISE.

[kthiruve · Accepted solution]

Please see this earlier community post that will give you information how to use this feature.

https://community.cisco.com/t5/policy-and-access/read-only-web-access-to-ise-nodes/td-p/2327124

-Krishnan