ISE LDAP Communication to Secondary AD

[Rob4]

Hi All,

I have a customer that connects their ISE deployment to their main Active Directory Domain. They are seeing traffic from a PSN to a secondary Active Directory domain that has a one-way trust with the main Active Directory domain. 

Is there any reason there would be traffic to the secondary domain if its not specified in the config? The secondary domain is not listed in the secondary domains for the ISE deployment. 

Appreciate any guidance. 

Thanks,

Rob 

[hslai · Accepted solution]

Such traffic is for AD domain and forest discovery.

[Rob4 · Accepted solution]

Thanks for the reply. So, if there was no trusting between the two domains, would we see that discovery still? 

Thanks,

Rob 

[hslai]

Yes.

[Rob4]

Thanks for the assistance. Do we have any documentation to show this behavior? The customer will need to provide some info to other team members. 

Thanks,

Rob 

[Nidhi]

I suggest going through Cisco Live session - BRKSEC-2132 which has information about discovery !

Thanks,

Nidhi 

[Rob4]

Thanks so much for the info!