New post on ignaonline.com by Sarah Chen:

Cisco AAA with TACACS+ and ISE on IOS-XE: Authentication, Authorization, and Accounting for Network Engineers

Default local credentials shared across dozens of devices are a security incident waiting to happen. In this guide, Sarah walks through the complete IOS-XE AAA configuration from scratch — TACACS+ server groups, authentication method lists with local fallback, per-command authorization via ISE policy sets, full accounting, and real-world troubleshooting tips.

Highlights:

• TACACS+ vs RADIUS: why TACACS+ wins for device admin
• Complete IOS-XE AAA config with VRF-aware TACACS+ server groups
• ISE Device Admin policy sets, shell profiles, and command-level RBAC
• Verification commands and live log analysis in ISE
• EEM applet for AAA failure alerting
• Production hardening checklist

Read the full post →