Hi,
I have two ISE 3.0 (Patch 2) appliances. I ran an Active directory diagnostic check on ISE01 and there are three warnings which I need to look into.
Both appliances are failing on the same three items.
ISE-01 ISSUE 1:
ISE-01 =
Test Name :DNS A/AAAA record low level API query
Description :Query for DNS A/AAAA record using resolv.conf configuration and res_query()
Instance :AD_Domain
Status :Warning
Start Time :23:07:17 03.11.2021 GMT
End Time :23:07:17 03.11.2021 GMT
Duration :<1 sec
Result and Remedy...
Large DNS reply (1648 bytes) found in Address Record query response.
Large DNS replies can impact efficiency and usually indicate that ISE is not using a good Active Directory Site, or the DNS server response contains too many records.
ISE-01 ISSUE 2:
Test Name :DNS SRV record query
Description :Query for DNS SRV record using resolv.conf configuration and gethostbyaddr
Instance :AD_Domain
Status :Warning
Start Time :23:07:17 03.11.2021 GMT
End Time :23:07:17 03.11.2021 GMT
Duration :<1 sec
Result and Remedy...
SRV record found.
Not all SRV records have IP, will need to run additional query for get IP.
ISE-01 ISSUE 3:
Test Name :DNS SRV record size
Description :Query for DNS SRV record size using resolv.conf configuration and gethostbyaddr
Instance :AD_Domain
Status :Warning
Start Time :23:07:17 03.11.2021 GMT
End Time :23:07:17 03.11.2021 GMT
Duration :<1 sec
Result and Remedy...
SRV query size exceeds maximum limit of 4k. This may have negative impact on AD functionality. Check AD DNS configuration.
Can ISE determine the following:
what SRV records do not have IP,?
what SRV query size exceeds the max limit?
Are there any AD tools that I can run on the Domain Controllers to try and resolve these three issues? Should I add in the other DNS servers that the customer has (roughly 60-70 servers)?
Thanks
Anthony.
