topic Were you able to resolve this in Network Access Control

AD automatically unjoin after a network change

cheungchunyu — Mon, 11 Mar 2019 07:15:58 GMT

Hello,

I discover that,some of our client do some network change(affect the connectivity between AD and ACS/ISE),Then ACS/ISE will unjoin AD automatically.We need to rejoin the AD again.

I would like to know that what is reason, ACS/ISE will unjoin the AD .

Any retry timer?

How long will unjoin the AD automatically,if the ACS/ISE cannot reach the AD

Duncan

Hello Duncan-

nspasov — Thu, 08 Dec 2016 02:19:46 GMT

Hello Duncan-

What type of network changes are you referring to? Also, are the nodes showing as "Disconnected" or completely "Disjoined" from the domain?

You may see this behavior if the communication between the AAA servers and your DCs is unavailable for an extended period of time. However, I have had one of my ISE nodes offline for several days and as soon as it comes back online it gets-reconnected to the domain.

Also, have you confirmed with your systems team that nobody is deleting/moving the ISE/ACS computer objects? 🙂

Thank you for rating helpful posts!

What type of network changes

cheungchunyu — Thu, 08 Dec 2016 03:20:19 GMT

What type of network changes are you referring to? Also, are the nodes showing as "Disconnected" or completely "Disjoined" from the domain?

I didn't remember the status at this moment.But I need to rejoin the AD to resume the services.

As you said" You may see this behavior if the communication between the AAA servers and your DCs is unavailable for an extended period of time.." I want to know the exactly the maximum value of the time period before the ACS unjoin or disconnect to AD.As the customer always ask this question.

You mention your case it is shutdown the ISE node,It is different from my case.In my case all the ACS/ISE/AD is alive,but the ACS/ISE cannot reach the AD only.(firewall change / switch/router maint window)

I can sure they type of case is often happen,so I believe that it is not related to deleting/moving the ACS/ISE computer object.(I know this will affect the ACS joining AD status,but it is not a one customer report to me.)

I am opened a case to cisco and the question is passed to BU(dev team),But I am still waiting the official answer from cisco.

Anyway,thank you for your share.

Were you able to resolve this

nspasov — Sat, 17 Dec 2016 21:02:20 GMT

Were you able to resolve this and did you hear back from TAC?

Hello,

cheungchunyu — Sat, 17 Dec 2016 23:22:11 GMT

Hello,

I am still waiting the tac reply.

He will resume to work at 19 Dec.

Hope I can get the answer shortly.

Duncan