ISE with ldap (Active Directory) authentication

[aquku]

Hello,

I have a problem with Cisco iSE in Active Directory domain as well as adding to the domain. I don't have much experience with ISA and RADIUS.

Join to Active Directory:

When I try to add ISE to a domain I get the message:

Error Description: The DC closed an LDAP connection in the middle of a query

Support Details...
Error Name: LW_ERROR_LDAP_SERVER_DOWN
Error Code: 40286

- DNS are configured correctly, nslookup sees the server, ping works for the domain, ntp server is configured.
- I'm using the domain administrator account for credentials

I did not configure anything on the domain controller

Are you able to help in the case of joining ActiveDirectory?

[marce1000]

 - This seems somewhat similar : https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvm87060 , what is your ISE version ?

 M.

[aquku]

Version: 2.6.0.156

[marce1000]

 - Following these info's you may want to debug the issue : https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/212594-debugs-to-troubleshoot-on-ise.html#anc24    and https://www.youtube.com/watch?v=z0OzlulOnsw 
  Possible use microsoft eventvwr and watch for related LDAP events , or else raise a TAC case , 

 M

[Christopher Bell]

LDAP or LDAPS?  Make sure the DC isn't expecting a secure connection and rejecting because it's not.  

[aquku]

I think that may be the problem. I did not create an encrypted connection between the ISE and the DC.
Is there documentation somewhere showing how to connect the ISE using LDAPS? Because in the settings I don't see the option to encrypt/add a certificate when adding or do I need to configure an external LDAPS connection and then try to add to the domain?

Domain Control is Windows Server 2019

I thought now if the problem could be "ip domain-name"? Because the person configuring ISE set ip domain-name to "cisco.com", host name "ise". When trying to add to the domain and see ise.cisco.com. Maybe this is the problem? What should I do in this case?