ISE Radius device administration authentication possible?

[joerg]

Hi,

does anybody know if Radius device administration authentication and authorization is possible with the actual ISE release? I know that TACACS will be available in future release.           

Regards

Joerg

[Eduardo Aliaga · Accepted solution]

Yes it's possible according to "Ask the experts" forum :

--------------------------

https://supportforums.cisco.com/thread/2172532

"If you use RADIUS for device administration, ISE can be utilized using authorization policy elements that return Cisco av-pairs.  But personally, I think ACS is currently superior to ISE for this task."

--------------------------

Anyway, I'm about to test "device admin" and "network access" simultaneously in the same switch with Radius and ISE.

Please rate if it helps

[joerg]

Hi,

thanks for your feedback.

Please post the results of your tests when have done them.

Regards

Joerg

[Tarik Admani · Accepted solution]

Yes you can use radius even in the ACS days for device administration, however command authorization is not a feature that works efficiently with radius.

If you are using IOS devices your authorization policy should send back the "cisco-av-pair=priv-lvl=15". Please consult the product documentaiton for a radius authentication and the radius av pair should be present in most guides. I know you can do this with IOS, NX_OS, WLC devce to name a few.

Thanks,

Tarik Admani
*Please rate helpful posts*