ISE 3.1 multi AD Domain Integration

[k7851610]

  There are two windows AD domains.

loclab.com
demo.local

I'm already joined loclab.com,but can't join demo.local.

Error message displayed on ISE:

Error Description: Failed To Find Domain Controller, Please Check Network Connectivity

Support Details...
Error Name: LW_ERROR_FAILED_FIND_DC
Error Code: 40049

Detailed Log:

Error Description :
Failed To Find Domain Controller In Domain DEMO.LOCAL : Domain Does Not Exists In DNS

Error Resolution :
Please Make Sure That Your DNS Contains Records For Domain : DEMO.LOCAL, For Further Information Please Refer To The AD DNS Diagnostic Tools

Join Steps :
18:22:33 Joining To Domain DEMO.LOCAL Using User Administrator
18:22:33 Searching For DC In Domain DEMO.LOCAL
18:22:33 Failed To Find Domain Controller In Domain DEMO.LOCAL : Domain Does Not Exists In DNS

This is the error message from the debug tool:

I refer to this document, but I don't know how to set it on DNS?

https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/ise_active_directory_integration/b_ISE_AD_integration_2x.html

Could not understand the following information:

please help

thx

[Flavio Miranda]

Basically it is saying that you need to have an Internet DNS service. If you have an Internal DNS server, then you can attend all this requirements easilly.

"

I refer to this document, but I don't know how to set it on DNS?"

But do you manage your DNS? it is a lab or real network? Which DNS are you using?

[k7851610]

yes .I manage DNS server.

it is a lab.

[Flavio Miranda · Accepted solution]

Which DNS are you using? 

You need to add  "A" host and IP address to resolve internal querries. This overcome what they call  recursive problem. You can create a zone as well.

If you manage the DNS is pretty straithforward but will require some "how to do" things. 

[k7851610]

windows server-DNS server

[balaji.bandi]

From ISE console or CLI, check are yo able to ping that domain, and make sure ISE and AD NTP time is sync.