topic Re: ISE2.4 version. Getting DNS error even though Name server is configured. in Network Access Control

ISE2.4 version. Getting DNS error even though Name server is configured.

techie21 — Thu, 29 Nov 2018 15:20:24 GMT

ISE 2.4 version:

Identity Services Engine

Alarms: DNS Resolution Failure

Description: DNS Resolution Failure on node
Suggested Actions: Check if the dns server configured by the command " ip name-server" is reachable

Getting DNS error even though Name server is configured. Error "DNS resolution failed for the hostname CNNAME against the currently configured name servers."

Re: ISE2.4 version. Getting DNS error even though Name server is configured.

pan — Thu, 29 Nov 2018 15:25:55 GMT

login to cli of node and do nslookup for the hostname of the ISE node for which you have alarm and check if nslookup is working?

Re: ISE2.4 version. Getting DNS error even though Name server is configured.

techie21 — Thu, 29 Nov 2018 16:06:16 GMT

Here is the nslookup:

msscidcISE01/admin# nslookup msscidcISE01
Trying "msscidcISE01.mss.tiss"
Trying "msscidcISE01"
Host msscidcISE01 not found: 3(NXDOMAIN)
Received 105 bytes from 209.29.2.44#53 in 1 ms

Re: ISE2.4 version. Getting DNS error even though Name server is configured.

pan — Thu, 29 Nov 2018 16:08:55 GMT

ok the problem is ISE is not able to do nslookup for hostname.

Please note ISE should be able to do forward and reverse dns lookup for itself and for all other node in the deployment.

Re: ISE2.4 version. Getting DNS error even though Name server is configured.

techie21 — Thu, 29 Nov 2018 16:14:13 GMT

I checked the configuration. I am able to ping Name Server from ISE:

ip name-server 209.29.2.44 209.29.2.45

msscidcISE01/admin# ping 209.29.2.44
PING 209.29.2.44 (209.29.2.44) 56(84) bytes of data.
64 bytes from 209.29.2.44: icmp_seq=1 ttl=63 time=0.604 ms

msscidcISE01/admin# ping 209.29.2.45
PING 209.29.2.45 (209.29.2.45) 56(84) bytes of data.
64 bytes from 209.29.2.45: icmp_seq=1 ttl=63 time=1.01 ms

I don't know where is the issue then?

Re: ISE2.4 version. Getting DNS error even though Name server is configured.

Jason Kunst — Thu, 29 Nov 2018 16:14:30 GMT

https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_01101.html#reference_EA017E71F25145C9A1374373ABFA102E

Re: ISE2.4 version. Getting DNS error even though Name server is configured.

pan — Thu, 29 Nov 2018 16:19:05 GMT

as said before issue is while doing nslookup for hostname of ISE, connectivity is fine.

Re: ISE2.4 version. Getting DNS error even though Name server is configured.

techie21 — Thu, 29 Nov 2018 16:19:33 GMT

What is this then? I guess I have the same issue:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCur14902/?rfs=iqvred

ISE DNS Resolution Failed for"hostname" from the ISE node "hostname"

CSCur14902

Description

Symptom:
The following alarm is generated during a dns failure:
DNS Resolution Failed for CNAME:"hostname" from the ISE node "hostname".

Even though the FQDN and the DNS response has the same FQDN

Conditions:
The behavior is consistent and does not impact any users.

Workaround:
Contact TAC to manually modify the alarm script

Further Problem Description:

Details

Last Modified:

Feb 13,2018

Status:

Fixed

Severity:

3 Moderate

Product:

(1)

Cisco Identity Services Engine

Support Cases: