cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
132
Views
0
Helpful
1
Replies
Highlighted
Cisco Employee

ISE-AD - DNS to ports => 49152

Hello,

 

Checking the integration guide for AD and Cisco (

https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/ise_active_directory_integration/b_ISE_AD_integration_2x.html#reference_94BE6ABB85BC47C8AEC29EF8D286E6E4) there is table that indicates the network ports that must be open for communications.

 

The first entry is the following:

Protocol

Port (remote-local)

Target

Authenticated

Notes

DNS (TCP/UDP)

Random number greater than or equal to 49152

DNS Servers/AD Domain Controllers

No

 

The way I read it is that we perform DNS queries from ISE nodes against DNS Servers/AD Domain Controllers not in the normal 53 port but in a random port => 49152. Is it correct?

 

I have been capturing traffic between my ISE nodes and AD and I did not see any connection to ports =>49152 in DNS Servers/Domain Controllers.

 

Thanks.

Everyone's tags (4)
1 REPLY
Participant

Re: ISE-AD - DNS to ports => 49152

The ISE servers will send out requests to DNS/AD controllers using high ports in the range from 49152 to 65535 as the source port with port 53 as the destination.

 

I just did a quick capture on our firewall that is in front of our ISE server and saw DNS requests with a source port of 46870 bound for 53 on our AD server.

CreatePlease to create content
Ask the Expert- Firepower configuration & troubleshooting