topic Re: Cisco ISE and Palo Alto TACACS in General Topics

Cisco ISE and Palo Alto TACACS

Stevenjwilliams83 — Wed, 15 May 2019 19:23:36 GMT

Few questions here.

Why do you need user local on the PA devices?

Why do you need those users local on the ISE box rather then allowing access from AD groups via ISE?

If the users are local then password changes are not possible when a user changes their AD password, so how does that work?

Re: Cisco ISE and Palo Alto TACACS

OtakarKlier — Wed, 15 May 2019 20:16:40 GMT

Hello,

In what context, i.e. the users?

Regards,

Re: Cisco ISE and Palo Alto TACACS

Stevenjwilliams83 — Wed, 15 May 2019 20:27:35 GMT

Yes for admin access with Cisco ISE, I have to create users local on the PA and local DB on the ISE/ACS server why cant it pass AD creds like my Cisco Devices?

Re: Cisco ISE and Palo Alto TACACS

OtakarKlier — Wed, 15 May 2019 20:32:35 GMT

Hello,

You should be able to. Check out this article.

https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-admin/firewall-administration/manage-firewall-administrators.html

Regards,

Re: Cisco ISE and Palo Alto TACACS

OtakarKlier — Wed, 15 May 2019 20:33:57 GMT

This one is more specific.

https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-admin/firewall-administration/manage-firewall-administrators/configure-administrative-accounts-and-authentication/configure-local-or-external-authentication-for-firewall-administrators.html