topic help, error connection Cisco Identity Services Engine with AD. in Network Access Control

help, error connection Cisco Identity Services Engine with AD.

JERRI - — Mon, 11 Mar 2019 03:28:02 GMT

Dear all,

I have Cisco Indentity Services Engine, that connected to Active Directory. When I test connection detailed,

the result is error, said:

Test Connection Results

This dialog shows the detailed logs for the operation for: idsv0018.

Status: FAILED: Global Catalog port status error.

Can anyone help?

I believe, because this error, I can't search group of AD, at Cisco ISE.

FYI: the connection from Cisco ISE to AD, joined with successful result.

Thanks,

Jerri

help, error connection Cisco Identity Services Engine with AD.

Leo Laohoo — Mon, 27 May 2013 03:03:14 GMT

Duplicate posts.

help, error connection Cisco Identity Services Engine with AD.

Ravi Singh — Mon, 27 May 2013 03:31:15 GMT

Yes leolaohoo is correct this error occur due to duplicate port. Please check the port setting.

help, error connection Cisco Identity Services Engine with AD.

JERRI - — Mon, 27 May 2013 03:34:27 GMT

Hi Ravi,

Where i should check my port setting?

fyi,

leolaohoo said duplicate post, not duplicate port.

thks,

Jerri

Re: help, error connection Cisco Identity Services Engine with A

Jatin Katyal — Mon, 27 May 2013 07:18:51 GMT

Can you do nslookup from the ISE CLI.

Was this working before and you rebooted your GC and after that you started seeing issue.

In your DNS settings can you see global catalog in the Forward Lookup Zone?

Jatin Katyal
- Do rate helpful posts -

Re: help, error connection Cisco Identity Services Engine with A

JERRI - — Mon, 27 May 2013 07:32:50 GMT

Hi Jatin,

Thanks for the reply.

yes, we can do nslookup from ise cli.

this problem already appear from the first time i try to test detail AD from CISE.

I can't retreive group of my AD, because of this.

where section, that i can see my global catalog in my DNS windows server?

Thks,

Jerri

Re: help, error connection Cisco Identity Services Engine with A

askhuran — Mon, 27 May 2013 11:57:54 GMT

Hello Jerri,

Please follow these steps:
1.    Make sure that ISE can connect to the Global Catalog (by Default it is Domain Controller) on the following ports (see table below)
2.    Check Windows Event Viewer > System Events on your Domain Controller and locate any errors / warning. Note down Event ID
3.    If there are any errors, other client computers in your AD domain are likely to experience problems locating User groups, Printers etc.
4.    If the above steps are confirmed, then you need to fix .msdcs.ad-domain.xyz and the records, on your primary DNS (Master Domain Controller by default)
5.    To fix those records, you may refer to the following link for more guidance on how to do it. Or your Windows AD Administrator should fix it

How DNS Support for Active Directory Works
http://technet.microsoft.com/en-us/library/cc759550

Otherwise let me know about the detail on Event IDs you notice in your Windows Event Viewer

Service Name	UDP	TCP
LDAP		3268 (global catalog)
LDAP		3269 (global catalog Secure Sockets Layer [SSL])
LDAP	389	389
LDAP		636 (SSL)
RPC/REPL		135 (endpoint mapper)
Kerberos	88	88
DNS	53	53
SMB over IP	445	445

Re: help, error connection Cisco Identity Services Engine with A

JERRI - — Wed, 29 May 2013 09:04:56 GMT

1. telnet from cise to AD server with port (all port in the table), can connected.

2. no error related to AD in the system events

3. users can locate printer, and others objects in the AD, and no problem with login (if GC problem, i think, login to domain, will also be problem)

4. DNS server

there is _gc (SVR type) in the

.msdcs.ad-domain.xyz -> gc -> sites -> name of the sites -> _tcp

But no_gc file (SVR type) in the

ad-domain.xyz at DNS server. folder _tcp.

so, i making this files.

But, still can't connect / find the GC / GC port status error , when detailed test in the Cisco ISE.

FYI, we have multiple domain in this company.

Didn't know what could be the problem, but

do you guys know how to repair GC in the AD?

Re: help, error connection Cisco Identity Services Engine with A

JERRI - — Thu, 30 May 2013 02:32:17 GMT

do anyone having a same problem when integrating AD multidomain with Cisco ISE?

Re: help, error connection Cisco Identity Services Engine with A

JERRI - — Thu, 30 May 2013 02:33:47 GMT

do anyone having a same problem when integrating AD multidomain with Cisco ISE?

Re: help, error connection Cisco Identity Services Engine with A

JERRI - — Thu, 30 May 2013 02:55:10 GMT

do anyone having a same problem when integrating AD multidomain with Cisco ISE?

help, error connection Cisco Identity Services Engine with AD.

Jatin Katyal — Thu, 30 May 2013 09:02:07 GMT

It's clears that when ISE tries to find the GC using the _gc._tcp. DNS query. It doesn't find that information on the Domain controller. The GC information is missing on the DC.

gc._tcp.DnsForestName

Allows a client to locate a Global Catalog (gc) server for this domain.

Jatin Katyal
- Do rate helpful posts -