Edit Active Directory Join in Cisco ISE v2.4

[Mike Pennycook]

Hi there,

We have ISE configured with an active directory (external identity source) join, which we use in our AAA rules.

The AD join points to a single domain controller for the ad domain.

We are now updating to new domain controllers and need to update the server that this AD join is pointing to. 

Can anyone help to identify where the domain controller can be updated? I dont see anywhere to edit the specific connection details. If I create a different AD join, then it says I cant have a duplicate AD join for the same domain. 

Many thanks for your help

[Mike Pennycook]

Please see the attached picture of the location in ISE that I'm referring to

Thanks

[Greg Gibbs · Accepted solution]

The Domain Controller that ISE communicates with should be controlled by the Sites configuration (found in AD Sites & Services) in your Domain. If you do not add the subnet for the ISE nodes to your Sites configuration, the DC that ISE chooses will be largely random. You can see this is the case as ISE shows the 'Default-First-Site-Name'

Best practice is to configure your AD Sites such that the ISE nodes communicate with the most efficient (typically the closest) DC. When you update your AD Sites configuration, ISE will automatically begin talking to the proper DC. If that DC becomes unavailable, ISE leverages the built-in HA capabilities of AD to select another DC.

Cheers,

Greg

[Cristian Matei]

Hi,

    As long as you keep the AD schema and database, and just add new AD domain controllers, or add new servers and FSMO roles, you'll have no worries. Just ensure that the DNS servers configured on ISE, point to your DNS servers from the AD.

Regards,

Cristian Matei.