topic ISE 1.2 patch 4 not retrieving groups in Network Access Control

ISE 1.2 patch 4 not retrieving groups

jgoethals — Mon, 11 Mar 2019 04:09:40 GMT

Since the update to ISE 1.2 patch 4 it isn't possible anymore to retrieve groups or attributes from the active directory. It keeps loading.

Anyone else experiencing this issue?

Regards,

Mathieu

ISE 1.2 patch 4 not retrieving groups

Naresh Ginjupalli — Fri, 06 Dec 2013 12:13:33 GMT

Hi Jeroen,

This is the only defect CSCuj95908 that is addressed in ISE 1.2 patch 4 from AD component. Is the patch successfully installed on the ISE node.

If possible can you try retrieving the groups & attributes by removing the Patch 4.

On my ISE node I am able to successfully retrieve the groups & attributes with ISE 1.2 patch 4.

ISE 1.2 patch 4 not retrieving groups

jgoethals — Fri, 06 Dec 2013 14:26:15 GMT

Ok, that bug will probably be resolved soon.

I couldn't find the open caveats in the release notes

ISE 1.2 patch 4 not retrieving groups

jrabinow — Sat, 07 Dec 2013 19:56:23 GMT

The issue you are referring to is documented in the following CDETS:

CSCul84544: Retrieval of AD groups or attributes is failing

This is not yet resolved. May be resolved in a future patch

The workaround given in the CDETS is

Fix the DNS server so that the reverse DNS lookup matches

I believe there are other steps that can be taken to mitigate this but would need intervention from TAC

ISE 1.2 patch 4 not retrieving groups

eng.malak — Mon, 16 Dec 2013 10:38:02 GMT

Hi Jrabinow/JEROEN

i will install patch 4 , is it just the ISE can't retrieve new groups ? do users still authenticate against existing groups and

corresponding policies ?

ISE 1.2 patch 4 not retrieving groups

jrabinow — Mon, 16 Dec 2013 11:26:20 GMT

Patch 4 will not resolve this. Fix will be in a future patch.

Issue impacts retrieval of groups from the GUI only (I corrected CDETS title to reflect this). Users are still able to authenticate against existing groups and corresponding policies

ISE 1.2 patch 4 not retrieving groups

Mathieu Sturm — Wed, 08 Jan 2014 11:50:59 GMT

Patch 5 doesn't resolve this either.

ISE 1.2 patch 4 not retrieving groups

jrabinow — Wed, 08 Jan 2014 18:42:57 GMT

This is not part of patch 5. Will be resolved in a 1.2 maintenance release called 1.2.1 that should be available some time in March.

in the interim I think there are a few options:

- manually enter group names

- contact TAC and quote the CDETS. There are some well understood workarounds that TAC can help you configure