topic Re: PassiveID add Domain Controller (missing DC) in Network Access Control

PassiveID add Domain Controller (missing DC)

csco11552159 — Thu, 20 Sep 2018 19:28:07 GMT

Recently we are trying to add new DCs into PassiveID list to use WMI monitoring.

The problems how ISE find the DCs, in our Dev environment, we found some DCs are missing from the list. and we have no way to add them.

when use :

nltest /dclist:dev

We will see 4 DCs.

But from PassiveID "Add Domain Controllers" list, cannot find all of them.

Then we test our production DCs, we have same issues, some "site" DCs are totally missing.

Is some kind reasons about DC"Site" ?

How does ISE find all DCs available to add?

Re: PassiveID add Domain Controller (missing DC)

Timothy Abbott — Thu, 20 Sep 2018 20:30:11 GMT

Hi,

It sounds like a configuration issue with AD. ISE gets the list of domain controllers when it joins the domain. There is no way to manually add DCs in ISE today.

Regards,

Tim

Re: PassiveID add Domain Controller (missing DC)

csco11552159 — Thu, 20 Sep 2018 21:36:07 GMT

we saw the same result for other domains. it seems site impacted PassiveID DCs....

Re: PassiveID add Domain Controller (missing DC)

Jason Kunst — Fri, 21 Sep 2018 02:01:45 GMT

I would suspect some issue with AD sites and services and misconfiguration of AD infrastructure since ISE cannot see them. I would open a TAC case to start and work with Microsoft as well to see where the problem lies

Re: PassiveID add Domain Controller (missing DC)

csco11552159 — Fri, 21 Sep 2018 04:20:29 GMT

Opened a ticket with TAC wait for some updates.

Psn with passive ID enabled only see the "site" DC which are auto associated with.

Passive wmi should see everything ..

Re: PassiveID add Domain Controller (missing DC)

csco11552159 — Fri, 21 Sep 2018 17:44:19 GMT

checked with our AD admin, our DNS only resolve some of DC based on domain

but ISE seems not to use API or similar cmd like" nltest /dclist:xxx.com" to resolve the DCs.

if this is the case, PassiveID wont work for lots cases especially when large amount DCs in the enterprise.

No one will display 100 DCs based on domain name ....

Re: PassiveID add Domain Controller (missing DC)

Jason Kunst — Fri, 21 Sep 2018 18:42:44 GMT

I would think that ISE needs all domains in DNS to be able to resolve and work with them. @Timothy Abbott is our SME will await for him to confirm. Right now it sounds like as before will need to tune AD to work with ISE.

Re: PassiveID add Domain Controller (missing DC)

csco11552159 — Mon, 24 Sep 2018 19:27:50 GMT

what if we deploy PSN to each "Site", witll ISE use site based DNS resolution to find all DC?

we do have all site based DNS resolution. If ISE is using this way, it should be able to see all DC at the "site".