We've recently installed a POC for Cisco ISE and have confirmed that we are able to log into the switches that poll it for RADIUS information. Since we've moved from TACACS+, we can't seem to find the area of ISE that contains the accounting information for commands entered on the switches/routers that poll ISE. Is there a comparable tool on ISE? Will it require extra commands be entered on the config level?
It was my understanding that Cisco's ACS+ was EOL, which is why we were moving to ISE in the first place.
Somewhere there was a misunderstanding because Cisco ACS 5.6 is currently supported.
Are you suggesting that we use ACS+ or are you saying ISE cannot perform accounting?
ISE is basically just a fancy RADIUS server, which is heavily focused on EAP / 802.1X. Save yourself pain and suffering, don't hammer the square peg (ISE) into a round hole (CLI accounting). Cisco ACS is designed for CLI accounting; ISE isn't.
ISE is a RADIUS server. A TACACS+ server such as Cisco ACS is required for the command level AAA you are looking for.
RADIUS - Remote Authentication Dial In User Service is primarily used for network access AAA.
TACACS+ - Terminal Access Controller Access-Control System is primarily used for Device Administration AAA.
TACACS+ provides for separate and modular authentication, authorization, and accounting facilities enabling more granular AAA, for example the ability to log each command entered by the different users and defining what commands a user may run. RADIUS cannot do this.
RADIUS encrypts only the password in the access-request packet, from the client to the server. TACACS+ encrypts the entire body of the packet.