# Configuring AAA on an FTD Appliance for Use with Cisco ISE

> Markdown source of <https://docs.calebsargeant.com/networking/cisco/core-security/network-security-with-cisco-firepower/2.-configuring-aaa-on-an-ftd-appliance-for-use-with-cisco-ise/>.

## Prepping Cisco ISE to Support RADIUS for Device Administration

<figure>
![configuring aaa on a cisco asa for use with cisco ise](../network-security-with-cisco-asa/_images/configuring-aaa-on-a-cisco-asa-for-use-with-cisco-ise-1.png)
<figcaption>Leverage AD security groups</figcaption>
</figure>

<figure>
![configuring aaa on cisco ios device for use with cisco ise](../network-security-with-cisco-ios/_images/configuring-aaa-on-cisco-ios-device-for-use-with-cisco-ise-2.png)
<figcaption>Define a network device</figcaption>
</figure>

## Role-based Access for Firepower Device Manager

- When devices use role-based access to determine privilege, RADIUS must be used as the AAA protocol.
- TACACS should be used when the device configured mainly through CLI, since TACACS allows each command to be authorized.

### Role-based Access Using FDM GUI

Cisco AV Pairs:

- Read-Only (`fdm.userrole.authority.ro`)
- Read-Write (`fdm.userrole.authority.rw`)
- Admin (`fdm.userrole.authority.admin`)

### Role-based Access Using FDM CLI

Service Types:

- Read-Only (`Service-Type:Administrator(6)`)
- Read-Write (`Service-Type:NAS Prompt(7)`)

## Configuring RADIUS Authorization Profiles for Device Administration on Cisco ISE

![image1](_images/configuring-aaa-on-an-ftd-appliance-for-use-with-cisco-ise-4.png)

## Configuring RADIUS Policy Sets for Device Administration Using RADIUS

<figure>
![configuring aaa on cisco ios device for use with cisco ise](../network-security-with-cisco-ios/_images/configuring-aaa-on-cisco-ios-device-for-use-with-cisco-ise-7.png)
<figcaption>Configure Device Admin Policy Sets</figcaption>
</figure>

## Configure Firepower to Use ISE as RADIUS Server for Device Administration

<figure>
![configuring aaa on an ftd appliance for use with cisco ise](_images/configuring-aaa-on-an-ftd-appliance-for-use-with-cisco-ise-1.png)
<figcaption>Authorisation Policy</figcaption>
</figure>

<figure>
![configuring aaa on an ftd appliance for use with cisco ise](_images/configuring-aaa-on-an-ftd-appliance-for-use-with-cisco-ise-2.png)
<figcaption>FTD Identity Source</figcaption>
</figure>

<figure>
![configuring aaa on an ftd appliance for use with cisco ise](_images/configuring-aaa-on-an-ftd-appliance-for-use-with-cisco-ise-3.png)
<figcaption>FTD Management Access</figcaption>
</figure>