Cisco ISE Join multiple Domain

[Mohamed BH]

Hi,

We have a Cisco ISE implementation with a single domain (Active Directory), we are trying to add an other domain (New Active Directory with a new Domain name separate from the old one) to our implementation, is it possible to do it, if YES how to do it ?

Kind Regards,

[Flavio Miranda]

Hi,

"Cisco ISE supports up to 50 Active Directory joins. "

 https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/ise_active_directory_integration/b_ISE_AD_integration_2x.html 

[Mohamed BH]

Hi @Flavio Miranda and thanks for you reply, i saw that but my problem is how to be able to configure the AD as a DNS on ISE to be able to see and reach the new domain when i add an other join point.

Example :

My ISE configuration is :

#domain-name example.com.fr

#ip name-server 1.1.1.1 2.2.2.2

The domain i want to add : example2.com.fr

what to do to reach the new domain ?

Kind Regards,

[Andres Sarmiento (Cisco)]

HI @Mohamed BH - from your config can ip name-server 1.1.1.1 2.2.2.2 resolve to the domain you want to add? - if this is the case then you will be able to accomplish this with no issues. Let us know if it does and if you re successful Joining the new AD Server to ISE

[Mohamed BH]

Hi,

Yes the ip name-server 1.1.1.1 can resolve the 2.2.2.2 domain but still i cant join the second domain from Cisco it hit me with :

Result for ISE node: ise.ccie.lab.

Status: Join Operation Failed: Failed to find domain controller, please check network connectivity

[Nancy Saini]

Yes, you can join ISE to another domain as a separate join point.

[Marcelo Morais · Accepted solution]

Hi @Mohamed BH ,

 at Administration > Identity Management > External Identity Sources > Active Directory > select your AD, check

1st the Allowed Domains tab ... Enable Select the Domains that you want

Note: special attention to the Use All AD Domains for Authentication option ... if checked the all current and future Trusted AD Domains will be used for Authentication.

2nd the Advanced Settings tab ... double check the information in the Identity Resolution window

Hope this helps !!!

[thomas · Accepted solution]

To add an Active Directory as an AD domain controller, add it the same way you did for the first one.

To add anything - including your AD server(s) - as DNS servers, you do this on the ISE CLI for each ISE node. You may add up to 3 DNS name-servers or you may add individual host aliases. Be aware that each new entry will require the ISE node to reboot.

See the ISE CLI Guide for all available commands:

ise/admin(config)#ip ?
Possible completions:
  default-gateway   Configure default gateway
  domain-name       Default domain name
  host              Configure host aliases
  name-server       Specify address of name server(s) to use