topic DCs not showing on ISE in Network Access Control

DCs not showing on ISE

PedroDias1994 — Mon, 13 Jul 2020 16:49:13 GMT

Hello,

I am integrating Cisco ISE with Microsoft AD and I am having a problem adding the Domain Controllers (DCs) on PassiveID.

I have already performed the 'Join' between ISE and AD successfully. Both ISE nodes are operational and I can see both DCs on the Connection tab, but when I go to the PassiveID tab to add the Domain Controllers, I can't find the 2 DCs....

Is some configuration missing on the DC side? On ISE?

Thanks for your help 🙂

Re: DCs not showing on ISE

Marius Gunnerud — Mon, 13 Jul 2020 18:12:42 GMT

Have you enabled Passive Identity Service under Administration > System > Deployment ?

Have a look through the following implementation guide. Perhaps it can lead you to what you are missing.

https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2019/pdf/LTRSEC-1655.pdf

Re: DCs not showing on ISE

PedroDias1994 — Tue, 14 Jul 2020 08:15:23 GMT

Hi Marius,

Actually, I am using ISE-PIC... so the passiveID services are already enabled.

Any other suggestion?

Re: DCs not showing on ISE

Marius Gunnerud — Tue, 14 Jul 2020 19:43:51 GMT

Could you provide a screen shot of the PassiveID tab to show what you are seeing, or more accurately, not seeing.

Also, could you go through the following document and see if you missed any steps while setting up your ISE-PIC.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/pic_admin_guide/PIC_admin26/PIC_admin26_chapter_010.html

Re: DCs not showing on ISE

PedroDias1994 — Thu, 16 Jul 2020 15:00:43 GMT

Hi Marius,

Here are some pictures describing what I wrote on the previous messages.

As you can see, the ISE-PIC nodes are integrated with the AD (Domain Controller - SECDCTST01), but the Domain Controller doesn't show on the list when I try to add it on PassiveID tab.

Thank you

Re: DCs not showing on ISE

Marvin Rhoads — Thu, 16 Jul 2020 19:20:21 GMT

Does ISE-PIC allow you to run the AD Diagnostic rule? I am wondering if perhaps you are missing SRV records for the DCs in your DNS zone. The Diagnostic Tool will tell you that (among other things).

Re: DCs not showing on ISE

PedroDias1994 — Fri, 17 Jul 2020 08:34:56 GMT

Hi Marvin,

I have figured it out a way to add the DC mentioned above 🙂

I don't know if it is a bug... but if I try to add the DC through Home > Introduction > Passive Identity Wizard, we reach a part where we can specify the DCs that we want to monitor. Choose 'Site Domain Controllers' and the DC will be there. If I choose 'Custom' I can't find it on the list presented by ISE-PIC...

Thank you Marius and Marvin for all your help!! This can be considered as the solution for this topic.