ISE Device Administration

Cisco ISE device administration oversees who can access network devices such as routers, switches, and firewalls. It utilizes the TACACS+ protocol and provides all three: authentication, authorization, and accounting, which helps to manage who can reach the appliance for administrative purposes.

TACACS+ serves as the foundation for setting up device administration in ISE. When someone connects to a device, TACACS+ checks who they are (authentication), confirms the person has permission to do what’s requested (authorization), and logs what they’ve done (accounting). It lets only the right people change your network devices.

Yes. To use TACACS+ for device administration, the Device Administration License is required. It is one license that you apply to all your ISE deployments, and it accounts for all your network devices.

The most common deployment models are as follows:

• Big Deploy: Utilizes two ISE nodes (cubes) for TACACS+ device admin and RADIUS network access.

• Medium Deployment: It will require to use of one cube with dedicated PSNs for every function.

• Small Deployment: Everything TACACS+ and RADIUS runs on a single ISE cube or node.

The best option for you will depend on your network size and redundancy requirements. TACACS+ and RADIUS can be deployed as standalone deployments or as a cohesive deployment serving both protocols. Whether you dedicate a separate instance of each is more of a security and operational policy decision. If your current separation of deployments is serving you well, continue with them separated.

Yes, you can. In small to mid-sized environments, a single ISE cube can handle both RADIUS and TACACS+ traffic. For larger deployments, it’s better to separate them into dedicated setups to improve scalability and performance.

Once you add the Device Administration License, you will be able to enable TACACS+ from your ISE setup. It requires that you enable TACACS+ services, and then define your network devices, and possibly policies to limit who can access and do what commands.