topic Passive ID Provider down - Alerting? in Network Access Control

Passive ID Provider down - Alerting?

InTheJuniverse — Wed, 12 May 2021 17:36:12 GMT

We are on ISE 2.4 and have configured AD <> ISE integration using WMI (to get information of AD users)

Some providers suddenly went offline for no reason, we had to manually add back integration

Is there a way to set an email alerting when a Provider goes offline? Screenshot attached

I had a look at Administration > System > Settings > Alarm Settings but nothing .

Re: Passive ID Provider down - Alerting?

InTheJuniverse — Wed, 12 May 2021 18:12:04 GMT

Work Centres > Passive ID > Reports > Passive ID

Severity : Error

Provider Type: WMI

Domain : xyz

Event: Cannot get Domain Controller NetBIOS

This is the alert that I am looking to setup email alerting for.

Re: Passive ID Provider down - Alerting?

Greg Gibbs — Wed, 12 May 2021 23:41:22 GMT

I don't believe there is an email alert for that event, but there are syslog messages related to it. You could look at sending logs for the Passive ID category to an external syslog server or SIEM and generating an email from there.

Re: Passive ID Provider down - Alerting?

faranzafar — Fri, 17 Jun 2022 20:28:52 GMT

I have the same issue, all of sudden all of my passive identity providers(wmi) based went down.
unable to bring them back.

Re: Passive ID Provider down - Alerting?

ahollifield — Mon, 20 Jun 2022 11:57:45 GMT

It is best to start a new community post for your specific issue.

https://community.cisco.com/t5/security-documents/how-to-ask-the-community-for-help/ta-p/3704356

https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/bulletin-c25-743964.html