topic Re: Cisco ISE Join multiple Domain in Network Access Control

Cisco ISE Join multiple Domain

Mohamed BH — Fri, 28 Apr 2023 14:45:59 GMT

Hi,

We have a Cisco ISE implementation with a single domain (Active Directory), we are trying to add an other domain (New Active Directory with a new Domain name separate from the old one) to our implementation, is it possible to do it, if YES how to do it ?

Kind Regards,

Re: Cisco ISE Join multiple Domain

Flavio Miranda — Fri, 28 Apr 2023 15:14:27 GMT

Hi,

"Cisco ISE supports up to 50 Active Directory joins. "

https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/ise_active_directory_integration/b_ISE_AD_integration_2x.html

Re: Cisco ISE Join multiple Domain

Nancy Saini — Fri, 28 Apr 2023 16:19:46 GMT

Yes, you can join ISE to another domain as a separate join point.

Re: Cisco ISE Join multiple Domain

Mohamed BH — Fri, 28 Apr 2023 16:25:23 GMT

Hi @Flavio Miranda and thanks for you reply, i saw that but my problem is how to be able to configure the AD as a DNS on ISE to be able to see and reach the new domain when i add an other join point.

Example :

My ISE configuration is :

#domain-name example.com.fr

#ip name-server 1.1.1.1 2.2.2.2

The domain i want to add : example2.com.fr

what to do to reach the new domain ?

Kind Regards,

Re: Cisco ISE Join multiple Domain

Marcelo Morais — Fri, 28 Apr 2023 18:38:45 GMT

Hi @Mohamed BH ,

at Administration > Identity Management > External Identity Sources > Active Directory > select your AD, check

1st the Allowed Domains tab ... Enable Select the Domains that you want

Note: special attention to the Use All AD Domains for Authentication option ... if checked the all current and future Trusted AD Domains will be used for Authentication.

2nd the Advanced Settings tab ... double check the information in the Identity Resolution window

Hope this helps !!!

Re: Cisco ISE Join multiple Domain

Andres Sarmiento (Cisco) — Fri, 28 Apr 2023 20:47:24 GMT

HI @Mohamed BH - from your config can ip name-server 1.1.1.1 2.2.2.2 resolve to the domain you want to add? - if this is the case then you will be able to accomplish this with no issues. Let us know if it does and if you re successful Joining the new AD Server to ISE

Re: Cisco ISE Join multiple Domain

Mohamed BH — Fri, 05 May 2023 13:17:28 GMT

Hi,

Yes the ip name-server 1.1.1.1 can resolve the 2.2.2.2 domain but still i cant join the second domain from Cisco it hit me with :

Result for ISE node: ise.ccie.lab.

Status: Join Operation Failed: Failed to find domain controller, please check network connectivity

Re: Cisco ISE Join multiple Domain

thomas — Sun, 07 May 2023 16:40:31 GMT

To add an Active Directory as an AD domain controller, add it the same way you did for the first one.

To add anything - including your AD server(s) - as DNS servers, you do this on the ISE CLI for each ISE node. You may add up to 3 DNS name-servers or you may add individual host aliases. Be aware that each new entry will require the ISE node to reboot.

See the ISE CLI Guide for all available commands:

ise/admin(config)#ip ? Possible completions: default-gateway Configure default gateway domain-name Default domain name host Configure host aliases name-server Specify address of name server(s) to use