topic AD Operational/Not Operational in Network Access Control

AD Operational/Not Operational

mick5kull — Wed, 05 Sep 2018 06:41:40 GMT

Hi experts,

Does ISE automatically leave from Active Directory domain and re-join during reboot if it is already joined?

Does ISE periodically communicate with Active Directory DC after it joined to a domain?

I read "Active Directory Integration with Cisco ISE 2.x" below but it only describe behavior on application reset or configuration restore.

'When you reset the Cisco ISE application configuration from the command-line interface or restore configuration after a backup or upgrade, it performs a leave operation, disconnecting the Cisco ISE node from the Active Directory domain, if it is already joined.'

https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/ise_active_directory_integration/b_ISE_AD_integration_2x.html#ID612

[Background]

My customer says they sometimes see "Not Operational" when checking AD integration status in [Administrator]->[External Identity Source]->AD domain after ISE reboot.

They say there seems no impact to user authentication during "Not Operational", but asking why ISE changes its status.

Re: AD Operational/Not Operational

kvenkata1 — Wed, 05 Sep 2018 16:03:20 GMT

If this is the behavior seen by your customer in production network, it is best handled by TAC. Please request your customer to open a TAC service request.

- Krish

Re: AD Operational/Not Operational

paul — Wed, 05 Sep 2018 16:11:29 GMT

Also part of the reason your authentications may not be affected is because by default is the authentication process fails on a PSN, the PSN will drop the request and allow the NAD to fail over to the another PSN.

As Krish said you definitely want to get a TAC case going.

Re: AD Operational/Not Operational

mick5kull — Thu, 06 Sep 2018 01:23:09 GMT

Thanks for your comment.

I understand "Not Operational" status after ISE reboot is not expected behavior and need TAC assistance.

Do you have any comments on below queries?

> Does ISE automatically leave from Active Directory domain and re-join during reboot if it is already joined?
> Does ISE periodically communicate with Active Directory DC after it joined to a domain?

If yes, I think customer and I should check network accessibility between ISE and AD controller more before open a SR on ISE.