Cisco ACS 5.7 how to change connection to new domain controllers

[IB1]

Hello,

How do you change/update the domain controllers the ACS nodes connect to?

We are migrating from the old to the new domain controllers. Cisco ACS is already configured to connect to the old domain controller. I want to change the connection to the new domain controllers, but I can't figure out how on the GUI. I looked at the ACS manual and online, but I have not been able to find the answer to my question.

Any help is appreciated. Thank you.

[andrew333 · Accepted solution]

IB1 - You configure Active Directory in ACS through the Users and Identity Stores > External Identity Stores > Active Directory menu. Beware that it's not just a case of changing to the new Active Directory though. If I recall correctly, you will need to re-import all the AD groups that are referred to in policies and update them in all the service policies. However, ACS is now end of life so you should really be migrating to ISE as soon as possible. Hope this helps.

[IB1]

Thank you for the information and the recommendation about migrating. It's helpful.

[Greg Gibbs · Accepted solution]

If you're not joining a different domain and simply want ACS to communicate with a specific Domain Controller as the primary one, this may be something you would just configure in AD Sites & Services.

Unless I'm mistaken, ACS acts the same as ISE when integrated with AD. It joins the domain as a computer account, so it uses AD's built-in mechanisms for determining the order in which to communicate with DCs and what to do in case of a DC failure. Make sure you've added the subnet where ACS resides into your Sites and that your Domain Controllers are setup appropriately in the domain.