cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2950
Views
5
Helpful
11
Replies

Kerberos check: sasl connectivity to AD failed

manvik
Beginner
Beginner

I have attached screenshot of the error. ISE  cannot connect to AD. All was working fine until ISE got hang. After it got rebooted, ISE can't joint o AD.

Tried all methods said in forums,. TAC troubleshooted for hours, but in vain.

 

Can someone help in getting this resolved.

11 REPLIES 11

marce1000
VIP Mentor VIP Mentor
VIP Mentor

 

 - Is there anything additional in the Windows AD-parent eventvwr concerning AD (error)-messages at the time ISE was supposed to reconnect ?

 M,

need to check on that, but there's a secondary ISE server. It's working perfectly. Both ISE servers were in Active-Passive HA.

 

 - You mean only passive-node has the problem and or it it a 'real problem' ?

    M.

Only the active device has issue.

 

 - If  your ISE setup is in 'dead water' as a result I would first consider patching up to the latest available in the current ISE version being used.

 M.

@manvik have you tried patching? Is your issue already resolved? I have the same issue.

It was an issue with AD server. once AD server got fixed, ISE worked perfectly.

What particular issue? Maybe there is some checking I missed, especially on the AD.

Cristian Matei
Collaborator
Collaborator

Hi,

 

    Before considering an ugly bug (which TAC should be aware about based on the version you're running), make sure that:

              - the required ports between ISE and DNS/AD servers are opened (maybe someone did some changes)

              - if the DNS server configured on ISE is not the same as your AD server, ensure that it can resolve all the FMSO roles of all DC's from your AD

 

Regards,

Cristian Matei.

Thank You,

- the required ports between ISE and DNS/AD servers are opened (maybe someone did some changes)

yes, it's opened. Both are in local LAN ntwork.

- if the DNS server configured on ISE is not the same as your AD server, ensure that it can resolve all the FMSO roles of all DC's from your AD

DNS is used as AD DNS server

Hi,

    

     Try patching first, rebooting second, rejoining AD third.

 

Regards,

Cristian Matei.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: