I just went through this yesterday on a new 3650 running IOS-XE 16.3.6. Using the same configuration, the switch was using the CON method list for login authentication, but using the VTY method list for authorization; i.e. sending exec and command authorizations to TACACS (ISE). Ultimately I ended up with the following config to meet my requirements; Config line con 0  exec-timeout 15 0  logging synchronous  login authentication CON line vty 0 15  exec-timeout 30 0  logging synchronous  transport input ssh ! aaa authentication login CON local aaa authentication login default group ISE-TACACS local aaa authorization console aaa authorization exec default local group ISE-TACACS if-authenticated  Results Console connections use the CON method list to authenticate and the default method list to authorize against local switch user(s) privileges. SSH connections use the default method list to authenticate and authorize against ISE/TACACS policies. The default authorization method list includes local and the ISE-TACACS group; the users authorize to whichever credential/method they authenticated with. ... View more

That's great to hear, because I admittedly threw in the towel with TCL and ended up with this script that still didn't work;   action 045 cli command "req plat soft pack clean sw all" pattern "Do you want to proceed" action 050 cli command "y"   The applet hits the 60s maxrun and gives up, but if I type the req plat soft pack clean sw all manually, I'm given the Proceed? prompt within approximately 15 seconds. Does the pattern pipe operate the same as a show command would, "or"?   Edit: Here is the script after changing the pattern to "proceed|#", it for some reason complaiend about the command.   Script; event manager applet pkg_clean event syslog occurs 1 pattern "%SYS-5-RESTART: System restarted" maxrun 300 action 000 syslog msg "\n ##Reboot detected, run 'pkg_clean' EEM applet." action 001 cli command "enable" !## Remove debug when done testing. action 002 cli command "debug event man act cli" action 005 cli command "conf t" action 010 cli command "no int vl 2" action 025 cli command "no event man app pkg_clean" action 030 cli command "end" action 035 cli command "write mem" action 040 cli command "req plat soft pack clean sw all" pattern "proceed|#" action 045 cli command "y" action 050 syslog msg "\n ##Config cleanup completed." action 055 cli command "undebug all"   Result; %HA_EM-6-LOG: pkg_clean:      ##Reboot detected, run 'pkg_clean' EEM applet. %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : Debug EEM action cli debugging is on %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : ACCESS-SW# %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : IN  : ACCESS-SW#conf t %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : Enter configuration commands, one per line.  End with CNTL/Z. %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : ACCESS-SW(config)# %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : IN  : ACCESS-SW(config)#no int vl 2 %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : ACCESS-SW(config)# %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : IN  : ACCESS-SW(config)#no event man app pkg_clean %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : ACCESS-SW(config)# %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : IN  : ACCESS-SW(config)#end %SYS-5-CONFIG_I: Configured from console by  on vty0 (EEM:pkg_clean) %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : ACCESS-SW# %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : IN  : ACCESS-SW#write mem %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : Building configuration... %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : [OK] %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : ACCESS-SW# %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : IN  : ACCESS-SW#req plat soft pack clean sw all %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : req plat soft pack clean sw all %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT :   ^ %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : % Invalid input detected at '^' marker. %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : ACCESS-SW# %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : IN  : y %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : % Bad IP address or host name% Unknown command or computer name, or unable to find computer address %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : ACCESS-SW# %HA_EM-6-LOG: pkg_clean:      ##Config cleanup completed. %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : IN  : ACCESS-SW#undebug all   I moved the request to first action after `enable`, but got the same result; %HA_EM-6-LOG: pkg_clean:      ##Reboot detected, run 'pkg_clean' EEM applet. %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : Debug EEM action cli debugging is on %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : ACCESS-SW# %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : IN  : ACCESS-SW#req plat soft pack clean sw all %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : req plat soft pack clean sw all %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT :   ^ %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : % Invalid input detected at '^' marker. %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : ACCESS-SW# %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : IN  : y %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : % Bad IP address or host name% Unknown command or computer name, or unable to find computer address %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : ACCESS-SW# %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : IN  : ACCESS-SW#conf t %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : Enter configuration commands, one per line.  End with CNTL/Z. %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : ACCESS-SW(config)# %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : IN  : ACCESS-SW(config)#no int vl 2 %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : IN  : ACCESS-SW(config)#no event man app pkg_clean %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : ACCESS-SW(config)# %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : IN  : ACCESS-SW(config)#end %SYS-5-CONFIG_I: Configured from console by  on vty0 (EEM:pkg_clean) %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : ACCESS-SW# %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : IN  : ACCESS-SW#write mem %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : Building configuration... %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : [OK] %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : ACCESS-SW# %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : IN  : ACCESS-SW# %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : ACCESS-SW# %HA_EM-6-LOG: pkg_clean:      ##Config cleanup completed. %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : IN  : ACCESS-SW#undebug all   But if I change the event trigger to none, it worked fine; ACCESS-SW#conf t ACCESS-SW(config)#event man app pkg_clean ACCESS-SW(config-applet)#event none maxrun 60 ACCESS-SW(config-applet)#end *Aug  5 2018 21:49:50.701 PDT: %SYS-5-CONFIG_I: Configured from console by admin on console ACCESS-SW#event man run pkg_clean %HA_EM-6-LOG: pkg_clean:      ##Reboot detected, run 'pkg_clean' EEM applet. %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : Debug EEM action cli debugging is on %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : ACCESS-SW# %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : IN  : ACCESS-SW#req plat soft pack clean sw all %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : Running command on switch 1 %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : Cleaning up unnecessary package files %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : No path specified, will use booted path flash:packages.conf %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : Cleaning flash: %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT :   Scanning boot directory for packages ... done. %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT :   Preparing packages list to delete ... %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT :     cat3k_caa-guestshell.16.03.06.SPA.pkg %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT :       File is in use, will not delete. %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT :     cat3k_caa-rpbase.16.03.06.SPA.pkg %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT :       File is in use, will not delete. %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT :     cat3k_caa-rpcore.16.03.06.SPA.pkg %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT :       File is in use, will not delete. %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT :     cat3k_caa-srdriver.16.03.06.SPA.pkg %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT :       File is in use, will not delete. %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT :     cat3k_caa-wcm.16.03.06.SPA.pkg %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT :       File is in use, will not delete. %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT :     cat3k_caa-webui.16.03.06.SPA.pkg %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT :       File is in use, will not delete. %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT :     packages.conf %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT :       File is in use, will not delete. %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : CTL : 20+ lines read from cli, debug output truncated %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : IN  : y %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : y^J %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : [1]: %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : Deleting file flash:cat3k_caa-guestshell.16.03.03.SPA.pkg ... done. %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : Deleting file flash:cat3k_caa-rpbase.16.03.03.SPA.pkg ... done. %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : Deleting file flash:cat3k_caa-rpcore.16.03.03.SPA.pkg ... done. %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : Deleting file flash:cat3k_caa-srdriver.16.03.03.SPA.pkg ... done. %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : Deleting file flash:cat3k_caa-universalk9.16.03.06.SPA.conf ... done. %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : Deleting file flash:cat3k_caa-wcm.16.03.03.SPA.pkg ... done. %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : Deleting file flash:cat3k_caa-webui.16.03.03.SPA.pkg ... done. %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : Deleting file flash:packages.conf.00- ... done. %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : SUCCESS: Files deleted. %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : ACCESS-SW# %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : IN  : ACCESS-SW#conf t %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : Enter configuration commands, one per line.  End with CNTL/Z. %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : ACCESS-SW(config)# %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : IN  : ACCESS-SW(config)#no int vl 2 %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : IN  : ACCESS-SW(config)#no event man app pkg_clean %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : ACCESS-SW(config)# %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : IN  : ACCESS-SW(config)#end %SYS-5-CONFIG_I: Configured from console by  on vty0 (EEM:pkg_clean) %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : OUT : ACCESS-SW# %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : IN  : ACCESS-SW#write mem %HA_EM-6-LOG: pkg_clean : DEBUG(cli_lib) : : CTL : cli_close called. tty is now going through its death sequence   ... View more

EDIT: For those wondering what my solution was, I was missing (global config): dot1x system-auth-control   So uh, mind sharing the solution? Having the same problem here. ... View more

Ken, thanks for your explanation, it helped me understand the function a little better.  This is my first time deploying a web filter of any kind.  Can you provide a configuration example of the monitor sessions for me? The ASA & S170 are connected to our 3750 stack as follows, with the intention of running the L4 traffic monitor in simplex mode. ASA > Fa2/0/1 S170 T1 > Fa2/0/43 S170 T2 > Fa2/0/44 I'm having a hard time with the config commands... monitor session 1 source interface fa2/0/1 monitor session 1 destination interface fa2/0/43 ingress Am I on the right path?  How do I bring fa2/0/44 into the config mix? ... View more