ISE 2.7: 172.16.1.11
AD: 172.16.1.10
vSwitch: 172.16.1.9
1. Install Device Admin license
Administration > System > Licensing, [Import License]
2. Enable Device Admin Service
Administration > System > Deployment >, click node "ISE27", check "Enable Device Admin Service"
3. Assume ISE is already added to AD, now create two new groups in AD:
Network Admin
Helpdesk User
4. Add above two AD groups to ISE:
Administration > Identity Management > External Identity Sources, expend Active Directory, select the AD "lab.local", click Groups tab, click Add > Select Groups from Directory.
5. Assume device is already added to ISE, configure device TACACS shared secret
In device setting window, check "TACACS Authentication Settings", input shared secret.
6. Configure two TACACS Profiles
Configure a basic TACACS Profile for Helpdesk Staff
Navigate to Work Centers > Device Administration > Policy Elements > Results > TACACS Profiles
Click Add to create a new TACACS Profile
Specify the Profile name as Helpdesk_User
Specify the Default Privilege as 1
Specify the Maximum Privilege as 15
Click Save
Configure a TACACS Profile for Network Admins with full privileges
Click Add to create a new TACACS Profile
Specify the Profile name as Network_Admin
Specify the Default Privilege as 15
Specify the Maximum Privilege as 15
Click Save
7. Configure TACACS Command Sets
Configure a TACACS Command Set with basic functionality
Navigate to Work Centers > Device Administration > Policy Elements > Results > TACACS Command Sets
Click Add to create a new TACACS Command Set
Specify the name as IOS_Basic_Commands
Click Grant and select PERMIT
Click Command and select the appropriate command e.g ping or traceroute
Configure a TACACS Command Set with full functionality
Navigate to Work Centers > Device Administration > Policy Elements > Results > TACACS Command Sets
Click Add to create a new TACACS Command Set
Specify the name as IOS_Full_Commands
Tick the box Permit any command that is not listed below
8. Define TACACS policy set
9. Define Authentication Policy
10. Define Authorization Policy
11. Switch configuration
tacacs server ISE27
address ipv4 172.16.1.11
key ******
!if you don't define an AAA server group for ISE, the default tacacs AAA group called tacacs+
!ISE defined above will be added to group tacacs+ automatically
!use default keyword in AAA commands, refer default tacacs group tacacs+
aaa new-model
aaa authentication login default group tacacs+ local
aaa authentication login NOAUTH none
! aaa authentication enable default group tacacs+
! aaa authorization config-commands
aaa authorization exec default group tacacs+ local if-authenticated
aaa authorization commands 1 default group tacacs+ local if-authenticated
aaa authorization commands 15 default group tacacs+ local if-authenticated
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 1 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
line con 0
privilege level 15
login authentication NOAUTH
!!When use default key word in above AAA commands, you don't need specify AAA in line VTY configuration
line vty 0 4
logging synchronous
!
!If aaa method is not "default", "line vty 0 4" needs add commands for AAA method:
line vty 0 4
login authentication [method]
authorization exec [method]
authorization command 1 [method]
authorization command 15 [method]
========== Other GUI access devices=======
1. ACI
shell profile:
custom attribute: shell:domains = all/admin/”
2. NetScout
shell profile
Access Control List - "groups=admin" ; groups are defined on netScout
3. F5
The content of attribute string doesn't matter, as long as match the shell profile on ISE. For example, use "F5-LTM-User-Info-1=admin" instead of the one on the screentshot below.
ASA:
1. Create aaa-server
aaa-server ISE protocol tacacs+
aaa-server ISE (inside) host 172.16.1.16
key *****
2. Enable TACACS on ssh, serial use local
aaa authentication ssh console ISE LOCAL
aaa authentication enable console ISE LOCAL
aaa authentication serial console LOCAL
3. Enable Accounting
aaa accounting ssh console ISE
aaa accounting enable console ISE
aaa accounting command ISE
4. Enable Authorization
! go to enable mode automatically
aaa authorization exec authentication-server auto-enable
aaa authorization command ISE LOCAL
! once above command is issue, you will get error to run any other commands
ciscoasa(config)# aaa authorization command ISE LOCAL
ciscoasa(config)# show run
Command authorization failed
ciscoasa(config)# sh ip
Command authorization failed
ciscoasa(config)#
In the ISE log, you will see the following entries. By default, Identity shows INVALID as username, you need to to Administration > Settings > Security Settings, tick "Disclose invalid usernames".
This is because your current session is not authenticated with ISE, so you can connect a new ssh session.
This may also impact your console session, then you have to create an enable_15 AD account and assign it to Network Admin Group which has full access.
Comments
Post a Comment