Cisco ISE Passive Identity Agent on Azure Domain Controller

[dimi.kard]

Hi All,

We have a Cisco ISE VM 3.1 version patch 10  which is only used to retrieve user groups from domain controllers in order to enforce the corresponding policies on FTDs.

Currently, we have installed Cisco Passive identity agent to all of our on prem Domain Controllers (Windows Server 2019 via RPC) with out any issue. We are trying to install the agent on a DC which is located in Azure without success. DC is also Windows Server 2019

There is site to site vpn between on prem site where Cisco ISE is located and DC in Azure all traffic is allowed.

Windows Firewall on DC is off

We've tried from the DC to telnet towards ISE ports and Connection works fine. 

On Windows Server agent logs we get the following message https://isenodefqdn:9095 with timeout

Could anyone assist on this ?

[Aref Alsouqi]

Could it be a DNS issue? have you tried to insall the agetn manually on Azure domain controller? if not, could you try that please?

Also, ISE PIC is already EoL but will still have support until Nov 2027. Why not to integrate your FMC with your AD directly by configure a realm bypassing the need to rely on ISE PIC?

End-of-Sale and End-of-Life Announcement for the Cisco Identity Services Engine Passive Identity Connector (ISE-PIC) - Cisco

[dimi.kard]

Hello @Aref Alsouqi 

We've tried to install agent manually but again when we check the status of the relevant DC on Cisco ISE it shows down.
Also the ad user has full privileges.
Regards

[Aref Alsouqi]

I see. I'm not good with Azure but could it be that Azure is not allowing the traffic between ISE and Azure DC? maybe you should allow it in Azure network security groups?

If you should want to explore the option to integrate the FMC with your AD directly you can check this post of mine:

FMC Identity Policy | Blue Network Security

[ahollifield]

Why use Passive ID at all? 

https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/identity-service-engine-software-3-1-3-2.html