DCs not showing on ISE

[PedroDias1994]

Hello,

I am integrating Cisco ISE with Microsoft AD and I am having a problem adding the Domain Controllers (DCs) on PassiveID.

I have already performed the 'Join' between ISE and AD successfully. Both ISE nodes are operational and I can see both DCs on the Connection tab, but when I go to the PassiveID tab to add the Domain Controllers, I can't find the 2 DCs....

Is some configuration missing on the DC side? On ISE?

Thanks for your help :)

[Marius Gunnerud]

Have you enabled Passive Identity Service under Administration > System > Deployment ?

Have a look through the following implementation guide. Perhaps it can lead you to what you are missing.

https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2019/pdf/LTRSEC-1655.pdf

[PedroDias1994]

Hi Marius,

Actually, I am using ISE-PIC... so the passiveID services are already enabled.

Any other suggestion?

[Marius Gunnerud]

Could you provide a screen shot of the PassiveID tab to show what you are seeing, or more accurately, not seeing.

Also, could you go through the following document and see if you missed any steps while setting up your ISE-PIC.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/pic_admin_guide/PIC_admin26/PIC_admin26_chapter_010.html

[PedroDias1994]

Hi Marius,

Here are some pictures describing what I wrote on the previous messages.

As you can see, the ISE-PIC nodes are integrated with the AD (Domain Controller - SECDCTST01), but the Domain Controller doesn't show on the list when I try to add it on PassiveID tab.

Thank you

[Marvin Rhoads]

Does ISE-PIC allow you to run the AD Diagnostic rule? I am wondering if perhaps you are missing SRV records for the DCs in your DNS zone. The Diagnostic Tool will tell you that (among other things).

[PedroDias1994 · Accepted solution]

Hi Marvin,

I have figured it out a way to add the DC mentioned above :)

I don't know if it is a bug... but if I try to add the DC through Home > Introduction > Passive Identity Wizard, we reach a part where we can specify the DCs that we want to monitor. Choose 'Site Domain Controllers' and the DC will be there. If I choose 'Custom' I can't find it on the list presented by ISE-PIC...

Thank you Marius and Marvin for all your help!! This can be considered as the solution for this topic.