ISE 1.1.1 and AD connect failure

Question

Hello,
I'm trying to join ISE to my AD. i have a linux vm as my time source for both AD/DC ( a vm) and ISE(actual appliance), both have sycn and time is the same on ISE and AD. I've opened all the ports and took off NAT between the two.
i get a successful join message, then it says "joined to domain but not connected"
i've turned off the windows firewall just in case.
in ISE i see:
base.bind.cache can't resolve LDAP service provider for test.com, check DNS
base.bind.healing disconnect reconnect failed
osutil module=LDAP SASL bind to ldap/[email protected] GSSAP mechanism with LDAP error invalid credentials
network.state favorite DC marked as dead
but i see other information that is being pulled from the domain correctly.
everything is in DNS.
any clues?
thanks

Answer 1

I recently ran in to this issue and here is what I did :
Did a "netstat -a -p tcp" on the Windows domain controller. Saw that Port 389 (LDAP) wasnt enabled (not sure on why this happened however). Got in to Windows services console (services.msc), "Stopped" and "Started" the "Active Directory Service". Checked with netstat to see if the port was open now, it was. I did a test from ISE and later "Joined" the AD, it turned successful!
Other options to look for:
Its evident that this errror corps up when ISE has problem with the LDAP service. So to resolve this, here are somethings to look at/do :
(1) Check connectivity between the ISE and the DC.
(2) Check if ISE can resolve the DC name (from the CLI mode)
(3) Check if the NTP is set properly on ISE (Administration -> Settings -> System Time)
(4) Check if port 389 (LDAP) is open on the domain controller.
(5) See if a router/Firewall is blocking the LDAP port
The "Detailed" test under "Test Connection" from ISE gives verbose information about the failure cause.
-Hari