topic ISE with ldap (Active Directory) authentication in Network Access Control

ISE with ldap (Active Directory) authentication

aquku — Tue, 18 Apr 2023 08:26:56 GMT

Hello,

I have a problem with Cisco iSE in Active Directory domain as well as adding to the domain. I don't have much experience with ISA and RADIUS.

Join to Active Directory:

When I try to add ISE to a domain I get the message:

Error Description: The DC closed an LDAP connection in the middle of a query

Support Details...
Error Name: LW_ERROR_LDAP_SERVER_DOWN
Error Code: 40286

- DNS are configured correctly, nslookup sees the server, ping works for the domain, ntp server is configured.
- I'm using the domain administrator account for credentials

I did not configure anything on the domain controller

Are you able to help in the case of joining ActiveDirectory?

Re: ISE with ldap (Active Directory) authentication

Mark Elsen — Tue, 18 Apr 2023 09:00:59 GMT

- This seems somewhat similar : https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvm87060 , what is your ISE version ?

Re: ISE with ldap (Active Directory) authentication

aquku — Tue, 18 Apr 2023 09:12:15 GMT

Version: 2.6.0.156

Re: ISE with ldap (Active Directory) authentication

Mark Elsen — Tue, 18 Apr 2023 10:28:12 GMT

- Following these info's you may want to debug the issue : https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/212594-debugs-to-troubleshoot-on-ise.html#anc24 and https://www.youtube.com/watch?v=z0OzlulOnsw
Possible use microsoft eventvwr and watch for related LDAP events , or else raise a TAC case ,

Re: ISE with ldap (Active Directory) authentication

Christopher Bell — Tue, 18 Apr 2023 14:17:39 GMT

LDAP or LDAPS? Make sure the DC isn't expecting a secure connection and rejecting because it's not.

Re: ISE with ldap (Active Directory) authentication

aquku — Wed, 26 Apr 2023 13:56:00 GMT

I think that may be the problem. I did not create an encrypted connection between the ISE and the DC.
Is there documentation somewhere showing how to connect the ISE using LDAPS? Because in the settings I don't see the option to encrypt/add a certificate when adding or do I need to configure an external LDAPS connection and then try to add to the domain?

Domain Control is Windows Server 2019

I thought now if the problem could be "ip domain-name"? Because the person configuring ISE set ip domain-name to "cisco.com", host name "ise". When trying to add to the domain and see ise.cisco.com. Maybe this is the problem? What should I do in this case?