topic Re: ISE server will not join AD in Network Access Control

ISE server will not join AD

kyle311 — Tue, 27 Aug 2024 16:10:54 GMT

I have a client who has 2 cisco ise 3.2 servers. When we try to join the first server to AD, it will fail out halfway through. There is connectivity between the ISE server and AD, as the network object will be created. However, the process dies out.

Any suggestions on what may be causing this?

Re: ISE server will not join AD

Rob Ingram — Tue, 27 Aug 2024 16:16:23 GMT

@kyle311 is ISE and Active Directory time in sync, the maximum time difference between AD and ISE can be is 5 minutes. https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/215233-identity-service-engine-ise-and-active.html

Does ISE provide an error?

Can ISE resolve the AD DNS names?

Re: ISE server will not join AD

kyle311 — Tue, 27 Aug 2024 19:35:09 GMT

Thanks for the response, Rob! the DC's and ISE servers are all in sync timewise. It will go through the point of creating an object in AD> It will then give an error "Cannot Join with DC (name of device), searching for another DC"

The Creds are valid and the user appears to have access if it is creating the object.

Any Idea what is causing this? I cannot create the Dot1x policies without this

Re: ISE server will not join AD

kyle311 — Tue, 27 Aug 2024 19:51:48 GMT

Also, yes, ISE can resolve DNS names. devices can resolve the servers by FQDN, also

Re: ISE server will not join AD

Abdullah@LTI — Wed, 28 Aug 2024 09:10:37 GMT

Hi Kyle311,

I once ran into this issue as well. Is there a firewall between the ISE servers and AD? If so, make sure that all mentioned ports are allowed in the firewall. Besides that, you mentioned that there are DNS entries created, did you also created the pointer records?

Best of luck.

Re: ISE server will not join AD

kyle311 — Wed, 28 Aug 2024 13:38:55 GMT

Hey Abdullah!

Thank you for your response. Unfortunately, there doesn't appar to be a firewall between the ISE Servers and the AD servers. The DNS and pointers are in place. I can ping the DC's fqdn from the servers command line. I can ping the ise server from the dc by fqdn. It makes absolutely no sense to me

Re: ISE server will not join AD

Abdullah@LTI — Wed, 28 Aug 2024 14:08:36 GMT

Can you share some screenshots and maybe the errors?

Re: ISE server will not join AD

MHM Cisco World — Wed, 28 Aug 2024 14:23:25 GMT

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/217351-ad-integration-for-cisco-ise-gui-and-cli.html

Use cli debug and share result here

Thanks

MHM