Question

A network engineer configures ISE for TACACS+ device administration. Network device groups, a TACACS+ device admin policy set, shell profiles, and command sets are all created correctly. However, when administrators attempt to log in to a switch using TACACS+, authentication fails and no live logs appear in the ISE Device Administration reports. RADIUS-based network access on the same deployment works fine. What is the most likely cause?

Accepted Answer

The Device Administration service is not enabled on any Policy Service Node in the deployment

Answer

The shell profile is missing a custom attribute for privilege level

Answer

The command set is set to deny all unmatched commands

Answer

The switch is configured to use RADIUS instead of TACACS+ for authorization