1. Clear the credentials from all the devices which are part of the HA setup. 2. Boot the stack setup and establish the device roles (active, standby, and members). 3. Configure the credentials on the active device. Use the Cisco TrustSec credentials id id password password command to configure the credentials. While adding a new device to an existing stack, ensure that you clear the credentials on the fresh device and then add it to the existing stack setup. Note PAC-less Authentication PAC-less mode streamlines the implementation of TrustSec policies by eliminating the need for PAC, which is typically required for secure communication between the devices and ISE.
In multi ISE node environment when the primary ISE node is unavailable, device can automatically switch to the secondary node without needing to re-establish PAC, ensuring minimal disruption. AAA PAC-less authentication simplifies the authentication process by eliminating the need for a PAC, improves scalability, enhances the user experience, and enables more modern authentication methods while aligning with Zero Trust security principles. In PAC-less mode, the devices initiate the process by sending a RADIUS request that includes the Cisco TrustSec username, password, and an EAP attribute message. The ISE then responds with a RADIUS access-challenge, proposing an EAP-FAST session.
Once the EAP-FAST session is established, the ISE returns the PAC opaque and PAC information. PAC opaque contains the PAC key and user identity, encrypted by the EAP-FAST server master key, while PAC info includes server identity and Time-to-Live timers. The PAC opaque is included in the Message-Authenticator field of subsequent Cisco TrustSec-generated RADIUS requests to the ISE, allowing the download of environment data and SGACL policies. Configuring Cisco TrustSec Credentials Perform this task for Cisco TrustSec to work on your device. Procedure Cisco TrustSec Overview PAC-less Authentication Command or Action Purpose Step 1 enable Example: Device> enable Enables privileged EXEC mode.
Enter your password, if prompted. Step 2 cts credentials id cts-id password password Example: Device# cts credentials id ctsid password abcd Configures the Cisco TrustSec device ID for this device to use when authenticating with other Cisco TrustSec devices with EAP-FAST because Cisco TrustSec requires each device in the network to identity itself uniquely. Cisco TrustSec Overview 7