ISE 2.4 patch 11 Secure ldap problem

[Moudar]

Trying to start using Secure LDAP but the problem is that when we test bind to server we get this massage:"ldap bind ended with an error" 

any ideas!?

[Moudar]

Is there any use guide with troubleshooting that we can use to implement secure ldap on ISE 2.4!

[hslai]

Damien Miller already gave some info on troubleshooting.

In case you are using the LDAPS from Google G-Suite or the like, that is not currently supported. Also, the LDAPS in ISE supports for encryption only but not for mutual authentication. The root CA of the LDAP server needs imported into ISE trusted certificates and trusted for client authentications.

[giovanni.augusto]

Thanks @hslai 

Is this still the case with newer ISE version?

I will probably ask a feature request to our Cisco representative but can you suggest if there is a specific internal reference for this feature?

[Damien Miller · Accepted solution]

I don't have a guide for this, but ensure that your are using the correct CA cert selections in the connection tab of the LDAP connector. Both sides need to trust each other.

There is also a section in the 2.6 admin guide that indicates what settings need to be enabled for certain ISE features to function. Look under the section titled "Configure Security Settings" which directs you to Administration > System > Settings > Security Settings in the GUI.
https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/admin_guide/b_ise_admin_guide_26/b_ise_admin_guide_26_chapter_010010.html

Someone else had suggested that you could enable debugs for prrt-JNI, AAA-runtime, AAA-config, then check the prrt-server.log file for more information on the errors.

Lastly, there is this terminated bug which indicates that ISE might not support mutual cert secure ldap authentication. I'm not sure if it still applies or not.
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvj82754

[Moudar]

is there any way to make sure that there is a trust between the two, what we know is that there is a trust but how to make sure?

[poongarg]

Take a packet capture on ISE with the filer " ip host <ip address of LDAP server> and check if the handshake between the two is completing or not.