cannot get past the enable mode in Cisco 9800

[atifali.zaidi1]

initially i did the base configuration for the new 9800 and added the below commands, the wlc is running 17.9.4a

line vty 0 15
privilege level 15
transport input ssh

and a username and password and enable secret password as well which is pretty simple and then as a prt of hardening and applying management configuration i had configured "no enable password" on the controller and since then i can initially login using tacacs with my username and password but then i am being presented with a enable prompt which is pretty strange and now i am stuck over there.  it does not accept my tacacs password and not even the initial password which was configured before.  any help will be deeply appreciated.

[marce1000]

   - SSH configuration contains : ...privilege level 15 ; I can't see this adding to security anyway :
  ref : https://www.ciscopress.com/articles/article.asp?p=3145772&seqNum=5

  >...

To use the TACACS+ server for CLI authentication, add your method in the VTY configuration (it is also configurable under Administration > Management>HTTP/HTTPS/Netconf/VTY in the WebUI after 17.6):

9800(config)#line vty 0 15
9800(config-line)#login authentication <aaa login method name>
9800(config-line)#authorization exec <aaa exec method name>

                 Check the document for complete info's

 M. 

[Ruben Cocheno]

@atifali.zaidi1 

Great guide that covers your needs

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/214490-configure-radius-and-tacacs-for-gui-and.html

[atifali.zaidi1]

the issue was on the ISE side as it was not pushing priv 15 access , it got fixed