topic Re: ISE 2.7 AD join - remove 2008 DC in Network Access Control

ISE 2.7 AD join - remove 2008 DC

rajitoor55 — Mon, 29 Nov 2021 16:33:37 GMT

We have AD joined ISE servers and 3 Doman Controllers. One of them is an old 2008 which we are trying to get rid of.

As soon as I block the traffic on the intermediate firewall, all authentications start failing. All traffic is confirmed allowed to new 2016 DC's. Why ISE is not moving to the new DC's and what can I do to make it work with new DC's.

Re: ISE 2.7 AD join - remove 2008 DC

Mark Elsen — Mon, 29 Nov 2021 16:44:04 GMT

- Not sure how traffic blocking is experienced by ISE when trying to connect to the old-DC , perhaps turn it off and keep it reachable. Sometimes there is a subtle difference between lost . unreachable or rejected connections. ? FYI : https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/ise_active_directory_integration/b_ISE_AD_integration_2x.html#reference_42F562CACEA745348AE47B601A29E151 but it does not immediately clear-up the subject.

Re: ISE 2.7 AD join - remove 2008 DC

Greg Gibbs — Mon, 29 Nov 2021 23:23:22 GMT

The Primary DC that the ISE nodes communicate with is controlled by the configuration in AD Sites and Services. If the Site showing in the ISE AD section says 'Default-First-Site' then you have not configured Sites correctly. You should have a Site that represents the physical/logical location(s) of the ISE nodes. The closet Domain Controller should be associated with that Site as should the IP address or subnet for the respective ISE nodes. After updating Sites, ISE will automatically begin communication with the relevant (non-2008) DC.

Re: ISE 2.7 AD join - remove 2008 DC

rajitoor55 — Wed, 01 Dec 2021 15:12:39 GMT

@Greg Gibbs and @Mark Elsen Thanks for your suggestions. We don't have Default-First-Site and all DC's show under there relative site names. I however looked into SRV records and all our DC's for this site were set to default priority and weight. I lowered the priority of 2008 server and now I see ldap and kerberos going to our preferred DC's. I then blocked all traffic to our DC's and everything still works. yay..