ISE 1.2 Active Directory Question

Hi,
I have a question regarding using Active Directory as an External Identity Source.
Our customer has 4 AD servers in their domain and thus 4 DNS entries for the domain. When I join ISE to the domain DNS resolves to one address and uses that machine to perform the join operation. What happens if the machine subsequently fails - does my ISE node need to leave and then re-join the domain or is this handled by some other method?
Thanks
Alan

Assuming that they're part of the same AD domain ISE will learn all of the DCs in the domain and you'll likely find after a while that it has moved to a different DC. We have over 100 DCs in our domain and it works just fine, no intervention is required to get it to connect to a different DC if the one it's connected to disappears.

Similar Messages

Call Manager 9.1 Active Directory Question(s)

Hello All!
Firstly let me establish that I am not an administrator of our VoIP system however I do manage the Server side of our network. We are in the process of planning an Active Directory upgrade and I'm having some difficulty getting a question answered about the requirements for Call Manager. We are at version 9.1 of Call Manager currently with our Active Directory version at 2003 R2. We are planning to upgrade to Active Directory version 2008 R2 (functional level) however we would like to use Server 2012 R2 as the OS for our AD servers. From a Microsoft standpoint this is a valid solution, it's built into Active Directory that you can run at different "functional levels" of AD on higher server operating systems. Any Call Manager applications that require a Windows operating system would run on whatever works for that (2003 or 2008 etc). Can we use Server 2012 R2 as the Domain Controller operating system while running at 2008 R2 functional level for Active Directory and still retain our Cisco support?

Hi Allen,
This is from Cisco site (you already may have seen this), though it talk about the directory services but it is specifically mentioned 2008. 2012 may work and specially as you are saying with functional level set to 2008 shouldn't have any issues. But Cisco have not tested that and you may get into support issues (if any).
Its completely tested and supported with CUCM 10.X
Version 9:
http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/9_0_1/ccmsys/CUCM_BK_CD2F83FA_00_cucm-system-guide-90/CUCM_BK_CD2F83FA_00_system-guide_chapter_010011.html#CUCM_TK_C4E65231_00
Configure LDAP directory
If you want to do so, you can add users from your corporate directory to the Cisco Unified Communications Manager database by synchronizing the user data to the database. Cisco Unified Communications Manager allows synchronization from the following directories to the database:
Microsoft Active Directory 2000
Microsoft Active Directory 2003
Microsoft Active Directory 2008
Microsoft Active Directory Application Mode 2003
Microsoft Lightweight Directory Services 2008
iPlanet Directory Server 5.1
Sun ONE Directory Server 5.2
Sun ONE Directory Server 6.x
OpenLDAP 2.3.39
OpenLDAP 2.4
Terry

Ise personas and Active directory

hello everybody ,
just a question...
which persona needs more bandwidth with Active Directory?
Supposing I have admin/monitor ----------firewall ----------- policy service
on wich side should I place AD ? (cause firewall limits bandwidth?)
thank you in advance for your response

The primary admin node and the policy service nodes. All nodes join to AD, but when you create groups in AD and build your polices that is done from the primary admin node, the PSN nodes are responsible for enforcing these policies. This is my personal opinion.
Thanks,
Tarik Admani
*Please rate helpful posts*

Cisco ISE 1.3 Active Directory issue

Hi Folks
I am having an issue with our Cisco ISE and would love some feedback or a solution. I have to ISE configured to use our Active Directory setup and so far it appears to be functional. I could connect to AD retrieve groups and use AD for authentication. The issue I am experiencing is that when I try to go to the 'Administration > Identity Management > External Sources page and select our AD instance from the left hand side window the screen locks up and refuses to load. Any advice?

hi
i also had this issue (and one of my collegue also) when using Firefox (version 34 and 35)
i managed to create the AD server using IE 10 for example, and after it appears correctly with Firefox
it was before ise1.3patch 1, but i have seen no corrected issue in patch1 release note for this problem
guillaume

ISE and MS Active Directory Integration Issue

It appears that our ISE 1.2 solution is having issues with nested MS AD Groups. The first login attempt always fails, the second occasionally works and the third always works. Has anyone else experience this login issues with ISE 1.2 and MS AD?
Sent from Cisco Technical Support iPhone App

Rick,
I am a little lost in the screenshots you posted. In your AD groups that you have pulled I dont see an authorization policy mapped to the first group. In the authentication report it looks like authentication is successfull.
I have seen that ISE will only display a few of the groups now in ISE 1.2 can you build a policy based on the the group you want it to show and then try your authentication again? That is when ISE will show the specific group as opposed to ise pre 1.2 where it would show more groups.
Thanks,
Tarik Admani
*Please rate helpful posts*

ISE Authentcation via Active Directory based on SSID and AD Group

Hi,
I am deploying ISE with WLC 7.4. I have two SSID(s) running in my network 1. Corporate & 2. Services. I have a domain setup lets say "AD.com" with 4 groups 1. Corporate, 2. Services, 3. Employees, 4. Contractors.
Here is an example of the scenario that I want:
AD.com Group : Corporate's User : 1. C_USER1
                                                    2. C_USER2
                                                    3. C_USER3
                                                    4. C_USER4
                                                    5. C_USER5
AD.com Group : Services's User :   1. S_USER1
                                                    2. S_USER2
                                                    3. S_USER3
                                                    4. S_USER4
                                                    5. S_USER5
Now what I want to do is have 802.1x authentication on my Corporate SSID that will check in AD.com, ONLY AND in ONLY corporate group for authentication. That is only C_USER1 to C_USER5 are allowed to connect to it. Users from any other AD group shouldnt be authenticated on this SSID.
The same for the services group & SSID.
Thanks.
Usama

Kindly   review:
https://www.cisco.com/en/US/docs/solutions/Enterprise/Security/TrustSec_2.0/trustsec_2.0_dig.pdf

Cisco ISE 1.2 and 2 Active Directory Domains

Hi Support,
does anyone know whether I can perform Certificate Authentication for two different Active Directory domains using the same ISE host / deployment?
We have two forests with a trust link between them.
We have a seperate PKI in each domain.
I am thinking that the ISE can only be joined to a single domain, but because we have a trust between the two forests, the ISE can have two certificate profiles in an identity source sequence which can then use in a single authorisation policy.
I take it that I would need local certs from each CA in the local certificate store of the ISE?
We are performing a company merger and we cannot migrate users to the primary AD domain due to several reasons so we would like to use the same ISE deployment to authenticate Wireless users on both AD domains.
Thanks
Mario

Mario,
This is possible. Here are the guidelines for the Multi-Forest support in ISE 1.2:
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_man_id_stores.html#pgfId-1350874
You would have to set a new Certificate Authentication Profile for each domain and use the Authentication Policies to determine which of the Certificate Authentication Profiles to use.
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_man_id_stores.html#pgfId-1349174
Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question. Otherwise, feel free to post follow-up questions.
Charles Moreton

ISE - Active Directory - LDAPS

I think I understood the customer concern. This is quoted from Microsofthttp://support.microsoft.com/kb/321051
"The Lightweight Directory Access Protocol (LDAP) is used to read from and write to Active Directory. By default, LDAP traffic is transmitted unsecured. You can make LDAP traffic confidential and secure by using Secure Sockets Layer (SSL) / Transport Layer Security (TLS) technology."
So the question now is how can we be sure the ISE communication is secure? ... I understand port 636 is used to transport LDAP-Secure ...
The ISE User Gude indicates that one of the ports required to be open in the case a firewall exists between ISE and ADE is 636 (LDAPS). -(ISE User Guide Page 5-6)
In my case there is no FW between ISE and AD, so how can I be sure LDAPS is being used?
ISE User Guide explais a little about security if the external identity source is an LDAP, but nothing about security is indicated in Active Directory configuration.
Regards.

Hi,
The AD join operations allows you to run PEAP protocol and is much more resilient than using ldap because of the way it joins itself to the domain. It uses kerberos and rpc when performing user authentication.
When using ldaps that is configuration based on when you add the ldap instance.
Sent from Cisco Technical Support iPad App

Active Directory Connector Questions in 11.1.2.1

Hello All. I am new to this version of IDM and I am trying to get through the setup and config. I just installed a single instance of 11.1.2.1 with OUD, OAM, OIM. I installed the Active Directory connector for User Management and I believe I have it configured.
I followed the post at Weblogic Corner: Oracle Identity Manager: The Active Directory Connector Tutorial and got a lot of questions answered with that. First, note that I was able to follow the guide and run the lookup recon jobs as well as the user and group recon in trusted mode, then target mode to create all of the users and groups. I am also able to create a user in OIM, add an account and have that provisioned to AD.
Here are my questions if you would be so kind:
1) When I create a user in AD and I run the user recon(target), the event says "No User Match Found". I was kind of expecting it to create a new user for me. I was also expecting to schedule the recon job in target mode and not have to ever switch back to trusted mode after the first full sync. What did I miss here?
2) When I add an account to the user in OIM, the AD User form comes up with all the fields empty. Is that the way it should work? I was hoping that it would prepopulate some of the stuff from the OIM profile.
3) When I modify a field in OIM, say middle name, will that sync in the next recon run, or will the admin need to open the account, update the AD form also and submit the middle name in two places?
Thanks in advance!

1. Identity gets created in Oracle Identity Manager from an authoritative source. in case of target recon, it will just sync with the matched account in oim.
please have a look in the below link seccion 12.1.12
Managing Reconciliation - 11g Release 2 (11.1.2)
2.u can very well prepopulate filed in the process definition, even u can automate the provisioning process using role based when provissioning process.
3.there should be some tasks available for each field. no need run the recon task or modify the account in AD. it will be updated in AD using the tasks. check the connector process definition.

ISE 1.2 Admin Access via Active Directory

Hi Experts,
Good Day!
I want to configure my ISE 1.2 to authenticate (for admin) against the active directory. I know it is possible but our AD doesn't have any groups named for admins.
Is it possible for the ISE 1.2 to configure a local user ID and check it to the AD for the password of the UserID?
Thanks for your great help.
niks

Niks,
I just got done doing this. First of all you have to have the Active Directory setup as an external data source. Once you do that Click on Administration - - Admin Access.
For the Authentication Type ensure that Password Based is toggled and change your data source to Active Directory (or whatever you named it).
Then click in Administrators - - Admin Users. Click Add a user - - Create Admin User. Ensure to check the External box and you will notice the Password field goes away. Fill out the appropriate information and then assign them to an Admin Group.
Once you are done with that you can test that user by logging out of your ISE session. You will notice that when you try to log back in you will have a choice of the data sources used to authenticate the user. Change the selection to Active Directory and enter the AD user/password for the newly created account you should be good to go.
Make sure that you don't delete or disable your original admin account in this process. (Change the password if you like.)

Active Directory Structure Questions

I recently started working for a company that offers cloud services for our clients where we host our software as a service and we also migrate any other applications the client is using onto the servers that we host for them.
My concern is that every client we have is in our domain. The structure of our servers is that our domain is the top of the organization and each client has their own dc and that dc is listed as an organizational unit in our AD. I have never seen anything
like it. Most of the clients have their own domains and web sites but we do not migrate that portion of their IT into our cloud. We do however bring everything else over and we offer O365 to many of them.
Imagine if you will opening ad users and computers and under the root all the OU's are named after clients and actually represent their servers all of which are dc's.
I was wondering what if any precedent would support this type of configuration? I am just asking.
Thanks
Richard Tamboli

No Special hardware is required for Active Directory
Active Directory is builtin feature for most of the Windows Servers such as Windows Server 2003, 2008,2008R2,2012.
It is a feature and part of Windows Server.
Hope this may answer your questions.
http://en.wikipedia.org/wiki/Active_Directory

Cisco ISE (Authentication failed: 24415 User authentication against Active Directory failed since user's account is locked out)

Hi,
I have a setup ISE 1.1.1. Users are getting authenticate against AD. Everything is working fine except some users report disconnection. I see in the ISE that (Authentication failed: 24415 User authentication against Active Directory failed since user's account is locked out). Users are using Windows 7 OS.
Error is enclosed & here is the port configuration.
Port Configuration.
interface GigabitEthernet0/2
switchport access vlan 120
switchport mode access
switchport voice vlan 121
authentication event fail action next-method
authentication event server dead action reinitialize vlan 120
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication order mab dot1x
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
mab
dot1x pae authenticator
dot1x timeout tx-period 60
spanning-tree portfast
ip dhcp snooping limit rate 30 interface GigabitEthernet0/2
switchport access vlan 120
switchport mode access
switchport voice vlan 121
authentication event fail action next-method
authentication event server dead action reinitialize vlan 120
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication order mab dot1x
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
mab
dot1x pae authenticator
dot1x timeout tx-period 60
spanning-tree portfast
ip dhcp snooping limit rate 30
Please help.

The error message means that Active Directory server Reject the authentication attempt
as for some reasons the user account got locked.I guess, You should ask your AD Team to check in the AD
Event Logs why did the user account got locked.
Under Even Viewers, You can find it out
Regards
Minakshi (Do rate the helpful posts)

Cisco ISE Failure: 24408 User authentication against Active Directory failed since user has entered the wrong password

Hi,
Since we implemented Cisco ISE we receive the following failure on several Notebooks:
Authentication failed : 24408 User authentication against Active Directory failed since user has entered the wrong password
This happens 2 or 3 times per Day. So basically the authentications are working. But when the failure appears, the connection is lost for a short time.
The Clients are using PEAP(EAP-MSCHAPv2) for Authentication. We've got a Cisco Wireless Environment (WLC 5508).
Why is this happening?
Thanks,
Marc

The possible causes of this error message are:
1.] If the end user entered an incorrect username.
2.] The shared sceret between WLC and ISE is mismatched. With this we'll see continous failed authentication.
3.] As long as a PSN not receiving a response from the supplicant within this limit during an EAP conversation, it will throw this error code. In majority of cases it says eap session timed out.
In your cases, the 3rd option seems to be the most closest one.
Jatin Katyal
- Do rate helpful posts -

Is it possible to map a Sponsor Group in Cisco ISE to a user group in Active Directory, through a RADIUS server?

Hi!!
We are working on a mapping between a Sponsor Group in Cisco ISE and a user group in Active Directory....but the client wants the mapping to be through a RADIUS SERVER, for avoiding ISE querying directly the Active Directory.
I know it is possible to use a RADIUS SERVER as an external identity source for ISE.....but, is it possible to use this RADIUS SERVER for this sponsor group handling?
Thanks and regards!!

Yes It is possible to map Sponser group to user group in AD and if you want to know how to do please open the below link and go to Mapping Active Directory Groups to Sponsor Groups heading.
http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_guest_pol.html#wp1096365

ISE 1.0.4 & Windows Active Directory

We are planning to add a NAC sollution in our network and we are a little confused with ISE. Can ISE support signle sign on with Windows Active Directory in this version 1.0.4? If yes how we can do it?
Thank you

Thanks for prompt answer,
Something more, i can't find in the following page which is the correct licence in order to install a DEMO ISE in my network. https://tools.cisco.com/SWIFT/Licensing/PrivateRegistrationServlet?DemoKeys=Y
Can you help me?

ISE 1.2 Active Directory Question

Similar Messages

Maybe you are looking for