topic Re: ISE LDAP Communication to Secondary AD in Network Access Control

ISE LDAP Communication to Secondary AD

Rob4 — Thu, 25 Jul 2019 18:22:29 GMT

Hi All,

I have a customer that connects their ISE deployment to their main Active Directory Domain. They are seeing traffic from a PSN to a secondary Active Directory domain that has a one-way trust with the main Active Directory domain.

Is there any reason there would be traffic to the secondary domain if its not specified in the config? The secondary domain is not listed in the secondary domains for the ISE deployment.

Appreciate any guidance.

Thanks,

Rob

Re: ISE LDAP Communication to Secondary AD

hslai — Fri, 26 Jul 2019 13:58:27 GMT

Such traffic is for AD domain and forest discovery.

Re: ISE LDAP Communication to Secondary AD

Rob4 — Fri, 26 Jul 2019 14:48:49 GMT

Thanks for the reply. So, if there was no trusting between the two domains, would we see that discovery still?

Thanks,

Rob

Re: ISE LDAP Communication to Secondary AD

hslai — Sat, 27 Jul 2019 23:54:36 GMT

Yes.

Re: ISE LDAP Communication to Secondary AD

Rob4 — Mon, 29 Jul 2019 19:39:40 GMT

Thanks for the assistance. Do we have any documentation to show this behavior? The customer will need to provide some info to other team members.

Thanks,

Rob

Re: ISE LDAP Communication to Secondary AD

Nidhi — Tue, 30 Jul 2019 04:04:09 GMT

I suggest going through Cisco Live session - BRKSEC-2132 which has information about discovery !

Thanks,

Nidhi

Re: ISE LDAP Communication to Secondary AD

Rob4 — Tue, 30 Jul 2019 13:25:22 GMT

Thanks so much for the info!