Who may type a command on a city switch, and what is recorded when they do. Sixteen years of it, across three platform generations.
It started as a procurement condition, not a feature request
In 2006, evaluating an alternative switch vendor, central administration was made a requirement of entry: equipment that could not be administered and logged centrally did not get onto the network.
That is the cheapest possible moment to impose a control. A requirement written into an evaluation costs nothing; the same requirement raised after purchase is a change request, and after deployment it is a replacement program. Most administrative-access problems are procurement decisions that were never made.
The estate ran TACACS+ on Cisco ACS through two major versions.
The accountability gap
Central authentication was working, and a class of switch in the estate would not record privileged commands. The platform could prove who logged in and not what they did afterwards — which is precisely the half an auditor or an incident responder needs. Authentication answers who; only command accounting answers what, and a control that stops at the first question is often mistaken for a complete one.
The platform decision, forced
The same platform then became a single point of failure for administrative access: once when its database corrupted, and again when a certificate expired. In both cases the team could not reach the box that controlled reaching everything else.
That is the standard objection to centralizing authentication, and it had now happened twice rather than being hypothetical. The migration to ISE was forced in 2021 on the back of a failed upgrade, and designed around those failure modes rather than around an assumption of availability — then integrated with network access control, so identity and enforcement worked from one source instead of two that could disagree.
How it closed
Multi-factor authentication on device administration against Active Directory, and an account naming standard separating internal from externally facing accounts, and network duties from security duties. Naming conventions look like housekeeping until an incident, when the question is which of forty accounts could have done this — and a scheme that answers that from the name alone is worth more than most controls that cost money.
Outcome
Central, logged, multi-factor administration of the network estate — and a replacement designed around the failure modes the previous platform had actually demonstrated.