5

We've recently installed a POC for Cisco ISE and have confirmed that we are able to log into the switches that poll it for RADIUS information. Since we've moved from TACACS+, we can't seem to find the area of ISE that contains the accounting information for commands entered on the switches/routers that poll ISE. Is there a comparable tool on ISE? Will it require extra commands be entered on the config level?

Improve this question
4
  • ISE isn't intended as a TACACS+ substitute, it's primarily used for client authentication (such as 802.1x / EAP). Are you trying to perform CLI command accounting with ISE or are you doing some form of 802.1x with it?
    – Mike Pennington
    Dec 22, 2014 at 14:39
  • We are mainly using it for 802.1x but we need something that performs CLI command accounting as well.
    – HAL
    Dec 22, 2014 at 14:44
  • You should use a real TACACS+ server for CLI accounting.
    – Mike Pennington
    Dec 22, 2014 at 14:47
  • It was my understanding that Cisco's ACS+ was EOL, which is why we were moving to ISE in the first place. Are you suggesting that we use ACS+ or are you saying ISE cannot perform accounting?
    – HAL
    Dec 22, 2014 at 14:56

2 Answers 2

Reset to default
4

It was my understanding that Cisco's ACS+ was EOL, which is why we were moving to ISE in the first place.

Somewhere there was a misunderstanding because Cisco ACS 5.6 is currently supported.

Are you suggesting that we use ACS+ or are you saying ISE cannot perform accounting?

ISE is basically just a fancy RADIUS server, which is heavily focused on EAP / 802.1X. Save yourself pain and suffering, don't hammer the square peg (ISE) into a round hole (CLI accounting). Cisco ACS is designed for CLI accounting; ISE isn't.

Improve this answer
2
  • I'll accept this answer. Do you know when 5.6 was released and when it goes EoL?
    – HAL
    Dec 22, 2014 at 15:23
  • 1
    As of September 30, 2014 ACS 5.4 (what I use) was announced for EOS; that same announcement lists ACS 5.6 as the migration path. ACS 5.6 is the latest, but I don't know precisely when it was released
    – Mike Pennington
    Dec 22, 2014 at 17:07
0

ISE is a RADIUS server. A TACACS+ server such as Cisco ACS is required for the command level AAA you are looking for.

RADIUS - Remote Authentication Dial In User Service is primarily used for network access AAA.
TACACS+ - Terminal Access Controller Access-Control System is primarily used for Device Administration AAA.

TACACS+ provides for separate and modular authentication, authorization, and accounting facilities enabling more granular AAA, for example the ability to log each command entered by the different users and defining what commands a user may run. RADIUS cannot do this.

RADIUS encrypts only the password in the access-request packet, from the client to the server. TACACS+ encrypts the entire body of the packet.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.