topic Re: ISE 2.4 patch 11 Secure ldap problem in Network Access Control

ISE 2.4 patch 11 Secure ldap problem

Moudar — Wed, 29 Apr 2020 11:13:34 GMT

Trying to start using Secure LDAP but the problem is that when we test bind to server we get this massage:"ldap bind ended with an error"

any ideas!?

Re: ISE 2.4 patch 11 Secure ldap problem

Moudar — Wed, 29 Apr 2020 11:51:12 GMT

Is there any use guide with troubleshooting that we can use to implement secure ldap on ISE 2.4!

Re: ISE 2.4 patch 11 Secure ldap problem

Damien Miller — Wed, 29 Apr 2020 17:36:25 GMT

I don't have a guide for this, but ensure that your are using the correct CA cert selections in the connection tab of the LDAP connector. Both sides need to trust each other.

There is also a section in the 2.6 admin guide that indicates what settings need to be enabled for certain ISE features to function. Look under the section titled "Configure Security Settings" which directs you to Administration > System > Settings > Security Settings in the GUI.
https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/admin_guide/b_ise_admin_guide_26/b_ise_admin_guide_26_chapter_010010.html

Someone else had suggested that you could enable debugs for prrt-JNI, AAA-runtime, AAA-config, then check the prrt-server.log file for more information on the errors.

Lastly, there is this terminated bug which indicates that ISE might not support mutual cert secure ldap authentication. I'm not sure if it still applies or not.
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvj82754

Re: ISE 2.4 patch 11 Secure ldap problem

Moudar — Thu, 30 Apr 2020 09:23:26 GMT

is there any way to make sure that there is a trust between the two, what we know is that there is a trust but how to make sure?

Re: ISE 2.4 patch 11 Secure ldap problem

hslai — Sat, 02 May 2020 05:10:15 GMT

Damien Miller already gave some info on troubleshooting.

In case you are using the LDAPS from Google G-Suite or the like, that is not currently supported. Also, the LDAPS in ISE supports for encryption only but not for mutual authentication. The root CA of the LDAP server needs imported into ISE trusted certificates and trusted for client authentications.

Re: ISE 2.4 patch 11 Secure ldap problem

poongarg — Mon, 04 May 2020 10:43:36 GMT

Take a packet capture on ISE with the filer " ip host <ip address of LDAP server> and check if the handshake between the two is completing or not.

Re: ISE 2.4 patch 11 Secure ldap problem

giovanni.augusto — Thu, 14 Jan 2021 10:47:01 GMT

Thanks @hslai

Is this still the case with newer ISE version?

I will probably ask a feature request to our Cisco representative but can you suggest if there is a specific internal reference for this feature?