TACACS+ for ISE CLI Login

[Sathiyanarayanan Ravindran]

Hello,

Am trying to configure TACACS+ for domain based authentication for ISE CLI. But am unable to acheive the same.Below is the configuration am performing at the ISE end.

username ad.1562798 password remote role admin

aaa authentication tacacs+ server 10.0.31.2 key authe

When ever I tried to login am not getting any logs. Am using the same server as TACACS+. Am I missing anything on configuration or TACACS+ login on CLI is not possible on ISE ?

[Surendra]

Currently ISE supports only local authentication. You cannot authenticate CLI user using any other method.
Those commands are not even available on ISE. Are you sure you have executed these commands on the ISE CLI ? If yes, which version?

[Sathiyanarayanan Ravindran]

Thanks Surendra,

Yes, I have executed this commands on the ISE CLI only. My current Version is 2.4.

[Sathiyanarayanan Ravindran]

Finally got a solution for having external identity store for CLI login of ISE from version 2.6 :)

https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/release_notes/b_ise_26_RN.html#id_97053

[Francesco Molino · Accepted solution]

Hi

As @Surendra mentioned, you can only use local database to authenticate on ISE CLI. Other methods aren't supported as far as i know (even on 2.4).
I've not checked yet on 2.5.

To be honest, it doesn't make sense to authenticate on himself (tacacs service) because it's stuck, you don't be able to access the Shell and it can be critical.