cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

1571
Views
5
Helpful
11
Replies
Highlighted
Beginner

Kerberos check: sasl connectivity to AD failed

I have attached screenshot of the error. ISE  cannot connect to AD. All was working fine until ISE got hang. After it got rebooted, ISE can't joint o AD.

Tried all methods said in forums,. TAC troubleshooted for hours, but in vain.

 

Can someone help in getting this resolved.

11 REPLIES 11
Highlighted
VIP Advisor

 

 - Is there anything additional in the Windows AD-parent eventvwr concerning AD (error)-messages at the time ISE was supposed to reconnect ?

 M,

Highlighted

need to check on that, but there's a secondary ISE server. It's working perfectly. Both ISE servers were in Active-Passive HA.

Highlighted

 

 - You mean only passive-node has the problem and or it it a 'real problem' ?

    M.

Highlighted

Only the active device has issue.

Highlighted

 

 - If  your ISE setup is in 'dead water' as a result I would first consider patching up to the latest available in the current ISE version being used.

 M.

Highlighted

@charleseapen have you tried patching? Is your issue already resolved? I have the same issue.

Highlighted

It was an issue with AD server. once AD server got fixed, ISE worked perfectly.

Highlighted

What particular issue? Maybe there is some checking I missed, especially on the AD.

Highlighted
VIP Collaborator

Hi,

 

    Before considering an ugly bug (which TAC should be aware about based on the version you're running), make sure that:

              - the required ports between ISE and DNS/AD servers are opened (maybe someone did some changes)

              - if the DNS server configured on ISE is not the same as your AD server, ensure that it can resolve all the FMSO roles of all DC's from your AD

 

Regards,

Cristian Matei.

Highlighted

Thank You,

- the required ports between ISE and DNS/AD servers are opened (maybe someone did some changes)

yes, it's opened. Both are in local LAN ntwork.

- if the DNS server configured on ISE is not the same as your AD server, ensure that it can resolve all the FMSO roles of all DC's from your AD

DNS is used as AD DNS server

Highlighted

Hi,

    

     Try patching first, rebooting second, rejoining AD third.

 

Regards,

Cristian Matei.

Content for Community-Ad