topic ISE Joined with AD but Some Groups Are Missing in Network Access Control

ISE Joined with AD but Some Groups Are Missing

SiJian Bao — Mon, 11 Mar 2019 03:32:50 GMT

Folks,

In my ISE, i have already joined my AD in a Windows 2008 server. But when I retrieve the groups with *, some groups are missing. I mean there is a group like XXX.COM\COMPANY\IDG\HR in my 2008 server, but i cannot retrieve that in my ISE, the group is Global. Is that a bug of ISE or are there some special limits in importing my groups into ISE?

Regards,

ISE Joined with AD but Some Groups Are Missing

Octavian Szolga — Mon, 17 Jun 2013 07:00:35 GMT

When importing AD groups in ISE using * you get max 100 group listed.

That doesn't mean that you group is not visible/'importable' to ISE

If you want to import a specific group, use *mygroupname*.

ISE Joined with AD but Some Groups Are Missing

SiJian Bao — Mon, 17 Jun 2013 07:49:58 GMT

Hello Sctavian,

Thanks for your help. But the number of the groups I retrieved with * does not reach 100, in fact it's 88, in this case, some groups are still missing.

I will try using add group directly.

ISE Joined with AD but Some Groups Are Missing

Venkatesh Attuluri — Tue, 18 Jun 2013 09:26:34 GMT

ISE can retrieve max 100 group list and as you have stated that the number did not reach 100 ,Check if the Active Directory configuration in the Administration ISE node user
interface is correct or you can add the missing groups directly use the following refer to adding groups manually

http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_man_id_stores.html#wp1059262

ISE Joined with AD but Some Groups Are Missing

SiJian Bao — Tue, 18 Jun 2013 13:37:40 GMT

Thanks Venkatesh! I think that may be a bug of ISE. I can add the missing groups directly with "Add > Add Groups" or using the command *the groups i want* with "Add > Select Groups From Directory"

ISE Joined with AD but Some Groups Are Missing

Jatin Katyal — Tue, 18 Jun 2013 14:04:50 GMT

Sijian,

As a work around have you tried to use a more granular filter to bring in chunks of groups at a time.

The limit will be increased in future. You amy also read the discussion happened on the similar issue:

https://supportforums.cisco.com/thread/2160538

Supported link:

http://www.cisco.com/en/US/docs/security/ise/1.1.1/user_guide/ise_man_id_stores.html#wp1059262

Jatin Katyal
- Do rate helpful posts -

ISE Joined with AD but Some Groups Are Missing

SiJian Bao — Tue, 18 Jun 2013 14:17:44 GMT

Jatin,

Yup, I succeeded to find my groups using granular filter like *Account*, Thanks for your help

ISE Joined with AD but Some Groups Are Missing

Jatin Katyal — Tue, 18 Jun 2013 14:23:43 GMT

Nice! thanks for updating the thread.

Jatin Katyal
- Do rate helpful posts -