topic Re: Integration of ISE to AD Per Site in Network Access Control

Integration of ISE to AD Per Site

fatalXerror — Thu, 29 Apr 2021 12:35:27 GMT

Hi Guys,

I have multiple ADs worldwide and my ISE is located in Los Angeles and when I integrate ISE to my AD domain ("us.example.com"), I want to make sure that it is connecting to my LA AD.

For me to do this, I need to have SRV record in my DNS right?

Thanks

Re: Integration of ISE to AD Per Site

Greg Gibbs — Thu, 29 Apr 2021 22:47:18 GMT

It sounds like you're talking about integrating ISE with a single Forest and Domain (join point) and you want the ISE nodes to communicate with the local Domain Controller in LA. Is that correct?

If so, you would do this using AD Sites and Services by ensuring that your DC is associated with a Site and adding the subnet used by the ISE nodes to that Site.

Re: Integration of ISE to AD Per Site

fatalXerror — Fri, 30 Apr 2021 02:57:36 GMT

Hi @Greg Gibbs , thanks for the feedback. Sorry but I cannot understand much in terms of AD terminologies but all I wanted to do is integrate my ISE to my domain (e.g. us.example.com) and I want to make sure that my L.A. AD should be the one to be integrate to my ISE.

My domain (e.g. us.example.com) consist of multiple ADs across the US that is why I want to make sure that my nearest AD will be the one that will be replying back to my ISE in L.A. that is why I was thinking if it is something to do with the SRV record that needs to be configured in the DNS to point the domain controller to L.A.

Thanks

Re: Integration of ISE to AD Per Site

Greg Gibbs — Fri, 30 Apr 2021 04:09:45 GMT

When the ISE nodes join the AD domain, they create computer accounts in the domain. This allows the ISE nodes to use Active Directory's built in high-availability and redundancy mechanisms. With an AD-integrated MS DNS server, it automatically builds SRV records based upon the model defined within AD Sites and Services.

Although you might be able to manually create SRV records in DNS (I've never tried it), you should be using AD's built-in mechanisms.

If you're not familiar with the AD functions, I would highly suggest discussing this topic with your AD administrators and referencing my comments around AD Sites and Services.