ISE-PIC AD DS (global vs site based SRV request)

Samuel Vuillaume — Thu, 22 Nov 2018 01:11:24 GMT

uys

My client is trying to integrate ISE-PIC with AD (for Passive auth) with “FMC”.

In the ISE-PIC Admin guide, I read "You might not be able to join Cisco ISE-PIC with an Active Directory domain if the DNS SRV records are missing (the domain controllers do not advertise their SRV records for the domain that you are trying to join to)"

When I sent this to my client, he replied with "That is our problem. Not all DCs can be resolved by global DNS SRV records. But we have all SRV records based by sites"

I have reached my AD DS knowledge on this last one.

Is there a way to address that issue on ISE-PIC?

Thank you

Sam

Re: ISE-PIC AD DS (global vs site based SRV request)

hslai — Sun, 16 Dec 2018 03:50:14 GMT

I hope you already engaged TAC to troubleshoot this. If I were you, I would enable DEBUG on the AD component and perform a packet capture of DNS requests from ISE-PIC and check what specific records are missing.

topic ISE-PIC AD DS (global vs site based SRV request) in Network Access Control

ISE-PIC AD DS (global vs site based SRV request)

Re: ISE-PIC AD DS (global vs site based SRV request)