topic ISE-AD Integration timeout value in Network Access Control

ISE-AD Integration timeout value

sikeda — Fri, 24 Aug 2018 04:01:34 GMT

Hi experts,

My customer is now planning to replace a 3^rd party RADIUS server to Cisco ISE. But they are much worried about AD timeout issue because they are running huge Windows domain network so that they have experienced Name resolution timeout with current radius server. (they tuned the timer)

Could you provide detailed information about

Default ISE Timeout value for Windows Domain Authentication
Can we tune a timer wit AD connection with “Advanced Tuning” under External Identity Sources? (it seems restricted for TAC use).
How does DNS A-record cache work in ISE with AD integration?

Any comment would be highly appreciated.

Re: ISE-AD Integration timeout value

RichardAtkin — Fri, 24 Aug 2018 11:04:35 GMT

Interesting question.

Maybe I'm being dumb, but what does the size of AD have to do with slow DNS responses? It feels like they want to manipulate ISE when really they should be fixing their DNS, but I suppose they have their reasons. Or do you mean that user lookups are also slow?

How many DCs do they have and how often do they change address / hostname? If DNS is slow you could always define the DC hostname / IP address associations manually and cut extrnal DNS out of the loop.

ip host [ipv4-address | ipv6-address] [host-alias | FQDN-string]

Feels a bit of a naff way to do it though. Hopefully somebody has a better idea...

Re: ISE-AD Integration timeout value

sikeda — Tue, 28 Aug 2018 04:44:26 GMT

Hi Richard,
Thank you for your suggestion! My customer agreed to try the "ip host" command to avoid the AD timeout in their test environment. Much appreciate for your help!