Login via TACACS not working with Cisco ISE

[RobertD1]

Hello,

Customer needs guidance on how to configure Cisco ISE to send AVP back to XIQ Site Engine to allow TACACS login.

We understand the following from the KB article:

Q A: HOW TO Configure TACACS+ Authentication In Extreme Management Center or ExtremeCloud IQ - Site ...

For ExtremeCloud IQ - Site Engine (XIQ-SE) the default group is "XIQ-SE Administrator".

But the customer would like to know how to configure Cisco ISE and has no documented example or screen shots to refer to, so if someone can provide where to configure the AVP that would be appreciated. I'm thinking it will need to be some kind of custom attribute with the group name as the AVP.

Thanks

Rob

[Robert_Haynes]

This may sound crass but isn't this a question for Cisco to answer?

The article provides an example of the AVP pair to return XMC-Authorization-Group="NetSight Administrator" which today is XMC-Authorization-Group="XIQ-SE Administrator". The role or service would also need to be defined in ISE. Our default is "Extreme-XMC-Auth" but this can be any string.

To debug Administration -> Diagnostics -> Server -> Server Diagnostics -> ExtremeCloud IQ - Site Engine User Authentication -> Verbose.

[RobertD1]

Thanks Robert. It is absolutely an issue on the Cisco ISE but we have a customer that is moving from Cisco to Extreme and is unfamiliar with XIQ SE. I was reaching out to see if anyone had experience of doing this that could shed some light. Thanks for the debug tip.

[RobertD1 · Accepted solution]

Got it to work by specifying AVP in a Custom Attribute for a shell profile (with no commands). Two phases. User was authenticated and then authorised for service group.