Problem AD with ISE

[Ahmed Zniti]

           The ISE Version 1.1.1 can't join the AD Domain it dispalys joinedn to domain but disconnected

[Karsten Iwen]

First make sure that NTP and DNS works correctly. If there are still problems after that activate and check the ad_agent.log:

Administration -> Logging -> Debug Log Configuration -> Active Directory

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

[Ahmed Zniti]

The NTP and DNS are correctly configured the problem persist the following is some debug log

Nov 22 18:51:54 DOTNISE-A adclient[22160]: DEBUG <59 capigetobjectbyname=""> base.adagent findObject: NotFound:radius-user Category:user

Nov 22 18:51:54 DOTNISE-A adclient[22160]: DEBUG <59 capigetobjectbyname=""> base.bind.cache making negative response for Person userPrincipalName="radius-user" (GC=0)

Nov 22 18:51:54 DOTNISE-A adclient[22160]: DEBUG <59 capigetobjectbyname=""> base.cache Cache store ;CN=CENTRIFY NEGATIVE RESPONSE,CN=Person,DC=ORANGETUNISIE,DC=INTRA : update indexes Yes

Nov 22 18:51:54 DOTNISE-A adclient[22160]: DEBUG <59 capigetobjectbyname=""> base.objecthelper 'radius-user' is not a canonical name

Nov 22 18:51:54 DOTNISE-A adclient[22160]: DEBUG <31 capigetobjectbyname=""> base.bind.cache making negative response for Person userPrincipalName="radius-user" (GC=0)

Nov 22 18:51:54 DOTNISE-A adclient[22160]: DIAG <33 capigetobjectbyname=""> base.bind.ldap X.X.X.X:389 search base="DC=OrangeTunisie,DC=intra" filter="(&(objectClass=User)(|(objectCategory=Person)(objectCategory=Computer))(sAMAccountName=radius-user-bt))"

Nov 22 18:52:17 DOTNISE-A adinfo[28473]: DEBUG util.except (Timeout) : RecvWait out (reference lrpc/ipc_sockio.cpp:155 rc: 0)

Nov 22 18:52:21 DOTNISE-A adinfo[28450]: DEBUG util.except (Timeout) : RecvWait out (reference lrpc/ipc_sockio.cpp:155 rc: 0)

Nov 22 18:52:21 DOTNISE-A adinfo[28452]: DEBUG util.except (Timeout) : RecvWait out (reference lrpc/ipc_sockio.cpp:155 rc: 0)

Nov 22 19:07:54 DOTNISE-A adinfo[28473]: DEBUG lrpc.session Reconnect to adclient failed: RecvWait out

Nov 22 18:52:21 DOTNISE-A adinfo[28481]: DEBUG util.except (Timeout) : RecvWait out (reference lrpc/ipc_sockio.cpp:155 rc: 0)

Nov 22 18:58:26 DOTNISE-A adinfo[28885]: DEBUG lrpc.session New socket 3 (36451094)

Nov 22 18:55:15 DOTNISE-A adinfo[28814]: DEBUG lrpc.session New socket 3 (36450306)

Nov 22 19:00:15 DOTNISE-A adinfo[28921]: DEBUG lrpc.session New socket 3 (36451586)

Nov 22 19:07:54 DOTNISE-A adinfo[28452]: INFO lrpc.session process authentication request failed: RecvWait out

Nov 22 19:07:54 DOTNISE-A adinfo[28450]: INFO lrpc.session process authentication request failed: RecvWait out

Nov 22 19:07:54 DOTNISE-A adinfo[28473]: INFO lrpc.session process authentication request failed: RecvWait out

Nov 22 19:07:54 DOTNISE-A adinfo[28481]: DEBUG lrpc.session Cannot communicate with adclient: RecvWait out. Rconnecting...

Nov 22 19:07:54 DOTNISE-A adinfo[28481]: DEBUG lrpc.session New socket 3 (36453156)

Nov 22 19:07:54 DOTNISE-A adinfo[28473]: DEBUG lrpc.session New socket 3 (36453157)

Nov 22 19:01:35 DOTNISE-A adinfo[28978]: DEBUG lrpc.session New socket 3 (36451892)

Nov 22 19:00:15 DOTNISE-A adinfo[28918]: DEBUG lrpc.session New socket 3 (36451578)

Nov 22 18:55:15 DOTNISE-A adinfo[28817]: DEBUG lrpc.session New socket 3 (36450314)

Nov 22 18:59:04 DOTNISE-A adinfo[28900]: DEBUG lrpc.session New socket 3 (36451246)

[Venkatesh Attuluri]

This scenario is most commonly caused by  clock drift due to not syncing time via
NTP1 on VMware (if you are using )
This issue can  also arise if the Cisco ISE FQDN2 changes and/or the name of the
certificate  imported on the client machine has changed.

Ensure that your Active Directory domain  and Cisco ISE are aligned to the same
NTP server source.
Shut down or  pause your Active Directory server and try to authenticate an employee
to the  network. try  ISE 1.1.3

[ryan ramandito]

Hi Ventakesh,

just got this kind of problem and what I do to fix this:

1. make sure no time skew on both AD & ISE

2. Resetting ISE on domain controller (computers > [ise_appliance_name] > reset account)

3. Re-join AD from ISE

Hopefully works for your problem