topic Re: Can we join Single Cisco ISE node to multiple Active Directory For in Network Access Control

Can we join Single Cisco ISE node to multiple Active Directory Forest/domains same time

aaggarwal23 — Fri, 11 Jun 2021 15:41:02 GMT

Hi,

Can some one please help to get an answer as mentioned in Subject if we can join Single ISE Node to Multiple Active Directory Domain/Forest same time. I am aware Cisco ISE support upto 50 Active Directory domain joined but i am not sure if we can join Single ISE node to Multiple Active Directory forest/Domain same time or not. Can some one please help me on this.

Re: Can we join Single Cisco ISE node to multiple Active Directory Forest/domains same time

thomas — Fri, 11 Jun 2021 23:53:48 GMT

Yes.

"50 Active Directory domain join points" means 50 unique domains/forests or 50 different places within a single domain.

From the ISE Admin Guide:

Re: Can we join Single Cisco ISE node to multiple Active Directory For

asdraper — Tue, 24 Dec 2024 21:18:31 GMT

Is there any way I can break the trust / prevent one domain join point from looking for accounts in other domains that have a trust?

I set up a new AD join point, and the account that was previously getting grabbed by the wrong domain and coming back as disabled is now working. The new problem, however, is that new join point is allowing authentication from multiple domains (since there are trusts between them) but I did not set up the AD groups for that join point, so now the accounts are failing authorization. I'm looking at having to add all the groups across every domain into each join point so they can be authorized regardless of which join point authenticates them.

That explanation is getting a little wordy, yikes.