Tacacs+ Cisco ISE config

[MarioMarquez]

Does anyone know how to configure the cisco ISE side? We can use tacacs now to access the gui but only local usernames and passwords work when trying to access the CLI using SSH. Does anyone have a complete cisco ISE setup? I found a guide to set up palo alto on the cisco ACS platform but ACS is end of life.

[tony.pshenichnykh]

Again, it really depends on what you are trying to do. If it's using ISE for TACAS and authenticate via AD then CHAP will not work. I have provided chart above in this article why it will not work.

If you are going to create local accounts on ISE then CHAP will work fine.
A lot of folks if you haven't noticed yet in their TACACS articles are using CHAP, yes, but they create accounts locally. No one mentions that AD for authentication using CHAP is not supported in ISE.

[tony.pshenichnykh]

Article shows using CHAP but accounts are locally created in ISE? It doesn't show using AD for authentication.

[sureshvina]

Oh yes, you are right. I remember configuring CHAP with AD and it didn't work so, had to revert back to PAP. CHAP will only work if you have local-ISE accounts.

[tony.pshenichnykh]

This is why CHAP will not work. I will repost the chart from previous page. This is supported by ISE. Palo Alto needs to more options in TACACS than just PAP/CHAP, and honestly I don't think PAP should even be an option.

Protocol (Authentication Type)	Internal Database	Active Directory	LDAP	RADIUS Token Server or RSA	REST	ODBC
EAP-GTC, PAP (plain text password)	Yes	Yes	Yes	Yes	Yes	Yes
MS-CHAP password hash: MSCHAPv1/v2 EAP-MSCHAPv2 (as inner method of PEAP, EAP-FAST, EAP-TTLS or TEAP) LEAP	Yes	Yes	No	No	No	Yes
EAP-MD5 CHAP	Yes	No	No	No	No	Yes
EAP-TLS PEAP-TLS (certificate retrieval) Note  For TLS authentications (EAP-TLS and PEAP-TLS), identity sources are not required but can optionally be added for authorization policy conditions. No Yes Yes No No No

[Murph]

I currently have this issue, Authenticatoin and Authorization passes in ISE and I can see the VSA String in the Response from ISE but I get not Authorized at the PAN GUI, anyone have luck in getting this resolved

[Murph]

Got it to work by following this link and these settings:

Typed everything in Raw View and I was able to auth....weird deal of affairs to get this to work.  "SYSTEM_RO" is the custom Role I created in PAN.

[AK74]

Glad that it did work for you.

Just two questions please :

- Did you use CHAP authentication protocol in PA FW ?

-Did you create local accounts on ISE & PA FW?

[Murph]

- Did you use CHAP authentication protocol in PA FW ? I used PAP

-Did you create local accounts on ISE & PA FW? No the only account I created was the account referenced by the VSA...which was System_RO....I then linked the account to specific AD Groups in ISE for Dynamic Role-Based Access