10-13-2022 07:58 AM - edited 10-13-2022 07:58 AM
Look at chart below, this is for Cisco ISE. Palo Alto only supports CHAP or PAP for authentication via RADIUS or TACACS+. In the chart, where it shows CHAP. ISE doesn't support LDAP. To answer your question, if you want to use TACACS then yes you would have to create accounts locally on ISE, but if you are already doing that then might as well create accounts locally on the Palo's with Authentication Profile to LDAP.
|
Protocol (Authentication Type) |
Internal Database |
Active Directory |
LDAP |
RADIUS Token Server or RSA |
REST |
ODBC |
||
|---|---|---|---|---|---|---|---|---|
|
EAP-GTC, PAP (plain text password) |
Yes |
Yes |
Yes |
Yes |
Yes |
Yes |
||
|
MS-CHAP password hash: MSCHAPv1/v2 EAP-MSCHAPv2 (as inner method of PEAP, EAP-FAST, EAP-TTLS or TEAP) LEAP |
Yes |
Yes |
No |
No |
No |
Yes |
||
|
EAP-MD5 CHAP |
Yes |
No |
No |
No |
No |
Yes |
||
|
EAP-TLS PEAP-TLS (certificate retrieval)
|
