LW_ERROR_JOIN_FAILED_REACHED_MAX_RETRIES

[dgaikwad]

Hi Experts,
I am trying to join another node to the our AD, but I keep on getting this error as follows:

Error Name: LW_ERROR_JOIN_FAILED_REACHED_MAX_RETRIES

Error Code: 60113

Detailed Log:

Error Description :

Join to mydomain.COM failed : reached maximum number of failovers

Error Resolution :

 Please check for domain controllers connectivity replication problems in domain mydomain.COM

Has anyone seen this one before?
Any pointer much appreciated.
Regards,

[nikhjadh]

Did anyone find the resolution for this issue?

[MHM Cisco World]

ISE integrated with only one AD domain 

If you want to add other domain use two way trust 

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/215225-ise-and-two-way-trust-ad-configuration.html

MHM

[nikhjadh]

Thank you for replying, but we have a single domain in use.

[PSM]

This looks related to the communication issue between ISE and AD. Had faced similar issue a while back and it was firewall dropping some of traffic. 

[nikhjadh]

Good to know. In our case we have it all internal and no firewall in between ISE and AD.

[PSM]

@nikhjadh Ok, One more thing, Is ISE subnet added in Active directory site ?

[CF09]

Its and old case but maybe its helpfull for some others persons who have the same issue

We updated CIMC und Bios and after that we were unable to join AD again and had the failure LW_ERROR_JOIN_FAILED_REACHED_MAX_RETRIES

we had a lot of troubleshooting with cisco.
No Firewall between ISE and AD all ports were reachable but we have TrendMicro with IntrusionPrevention and there was the Problem. It seems that ISE using an older protocoll to reach AD for joining and TrendMicro detected these kind of connection as vulnerability and blocked the connection between ISE and all of our DCs.

TrendMicro deteced in this Rule : Windows Vista SMB2.0 Negotiate Protocol Request Remote Code Execution . A vulnerability exists in Microsoft Windows (srv2.sys) that may result in a denial of service attack. The flaw is attributed to the method in which srv2.sys processes malformed SMB headers for the Negotiate Protocol Request. CVE-2009-2532

After excluding ISE from this Rule the AD join was possible.

Greetings