topic Re: ISE 2.7 not fetching AD-Groups-Name attribute from Active Director in Network Access Control

ISE 2.7 not fetching AD-Groups-Name attribute from Active Directory

Isildur — Mon, 08 May 2023 23:23:08 GMT

Hello Guys,

I´m doing an eap chaining lab using ISE 2.7 and Windows Server 2016. Almost everything is working fine but I´m stuck in this "problem". I want to create Authz rules based on AD Security Groups but during a user authentication, ISE for some reason don´t retrieve the AD Groups in which the user belongs to, So the Authz fail and the authentication is denied.

Have you guys ever seen this behavior? What can it be?

Re: ISE 2.7 not fetching AD-Groups-Name attribute from Active Director

poongarg — Tue, 09 May 2023 00:31:07 GMT

Perform a test user authentication from ISE GUI. Under External identity Stores > Select Active Directory Join point name > Click Test user and check if you are able to fetch user attribute normally or not. If not, it may be a permission issue on AD.

Re: ISE 2.7 not fetching AD-Groups-Name attribute from Active Director

Greg Gibbs — Tue, 09 May 2023 00:46:10 GMT

From a AD permissions perspective, group matching issues can be caused by the ISE machine account not having the permission to read tokenGroups. See the following document for the required AD permissions.

Active Directory Integration with Cisco ISE 2.x

There are also bug fixes related to AD Group matching in various patches for ISE 2.7 and you did not specify what patch level you have installed. If you are not using the latest patch for 2.7 (currently patch 9), then you should start by updating to the latest patch.

Re: ISE 2.7 not fetching AD-Groups-Name attribute from Active Director

Arne Bier — Thu, 11 May 2023 20:48:16 GMT

@Isildur - perhaps you're running into this defect CSCvz85074 that also affects ISE 2.7

Re: ISE 2.7 not fetching AD-Groups-Name attribute from Active Director

Isildur — Fri, 12 May 2023 20:26:33 GMT

I was using ISE 2.7 with no patch and the problem was resolved after I updated to the last patch.

Thank you very much guys!!