topic Re: ISE 3.0 LDAP Integration - Cannot retrieve groups in Network Access Control

ISE 3.0 LDAP Integration - Cannot retrieve groups

mattw — Fri, 27 Aug 2021 15:32:05 GMT

Hello!

I am helping a customer who is attempting to integrate their ISE 3.0 instance with LDAP. They have configured the LDAP external identity source in ISE and a test bind works fine.

However, when they go over to the groups tab and click on retrieve groups, nothing is displayed. No groups and no errors.

Their LDAP admin says he sees the request received from ISE and he sees the LDAP server respond to ISE.

I know we can do a TCP dump to see the traffic between ISE and LDAP and this might help. Maybe.

Are there any other options for debugging or obvious things to check?

Many thanks in advance,

Matt.

Re: ISE 3.0 LDAP Integration - Cannot retrieve groups

Marcelo Morais — Fri, 27 Aug 2021 17:00:41 GMT

Hi @mattw ,

at Administration > Identity Management > External Identity Sources > LDAP > select you LDAP > select the Connection tab > click the Test Bind to Server icon ... double check the Number of Groups:

If the Number of Groups is 0, then please check the Directory Organization tab configuration, Subject and Group Search Base.

Hope this helps !!!

Re: ISE 3.0 LDAP Integration - Cannot retrieve groups

mattw — Fri, 27 Aug 2021 21:59:47 GMT

Hi @Marcelo Morais,

Thank you for your input. We did check this and it showed >0 groups (I think it was around 50). Just seems really strange that we cannot retrieve the list?

Thanks!

Matt.

Re: ISE 3.0 LDAP Integration - Cannot retrieve groups

Marcelo Morais — Sat, 28 Aug 2021 20:43:33 GMT

Hi @mattw ,

in this case ...

1st start a TCP Dump from the PAN using the filter:

ip host <LDAP IP Addr> and port <LDAP Port>

2nd retrieve the Groups

3rd stop the TCP Dump and check if you receive any packet.

Hope this helps!!!

Re: ISE 3.0 LDAP Integration - Cannot retrieve groups

mattw — Mon, 30 Aug 2021 19:32:55 GMT

Thanks you again @Marcelo Morais for your help. I did suggest this to them last week along with enabling debug logging and collecting and analysing a support bundle. I think they have solved it now but I need to hear back from them tomorrow.

Thanks!

Matt.

Re: ISE 3.0 LDAP Integration - Cannot retrieve groups

mattw — Tue, 07 Sep 2021 08:51:14 GMT

Just to close this out, we found the solution was to remove Group Name Attribute = cn from LDAP > General, then retrieve the groups, then put cn back in. Weird.