ISE 1.3 / WLC 8.x + Server 2012 R2

Question

Hi All,
Just wondering if anyone has seen this issue and if so – a solution or any advice would be great!
Scenario.
ISE 1.3 is connected to Server 2012(R2) AD – and this is showing as connected and all tests are successful.
ISE is Connected to WLC 8.x  (Tests on attachment showing succesfull)
The permissions of the service account I used for ISE to link in with AD – "domain admin" and also tried  "domain users" (using domain users now) and we can see AD security groups etc
- WLC is succesfully connected to ISE
SSID "Test" is configured to send to AAA - ISE
ISE has a policy that permits "domain users" on the network.for web authentication
Issue I am experiencing is when I connect to the SSID I get prompted for a login - this is my domain account it’s looking for
(my account is a member of domain users only)
===============================================
I get a message on BYOD Portal   (SEE ATTACHED SCREENSHOTS)
 “Unable to obtain the user information needed for network access. Try again”
===============================================
If I use an account that has domain admin rights – everything works fine every time??  and I can start the process of registering my device on the network??
I would like to rule out AD if i can. (Win Server 2012 R2) -
everything looks ok from ISE as we can see AD groups etc when you select "retrieve AD groups"  - i can see all built in groups etc ....
We get authenticated fine -  the issue appears to be in the web-redirect and it seems like you need to be a domain admin for us to get the correct registration page.
Any help would be great
Thanks
James

Answer 1

HI David
Many thanks for your response.
Yeah I have tried different users and also on ISE different groups and cross checked the SID on ISE groups to the SID on the AD group and seems both match.
My colleague is doing the ISE part and I am doing the Windows 2012R2 part and all looks ok – the service account seems to be testing out fine when running tests on ISE and displaying groups etc when I "retrieve groups from AD" (from ISE)
The finger at this time seems to be pointing at my AD …due to the domain admin accounts working and domain users not (I know these are both domain users but as my colleague is the “boss” I just need to make sure 110% that there is no special requirements that I need to add to the computer account & or the user account
From the Cisco doc’s the service account just needs to be a domain user to read AD but is there anything special with the ISE computer account? – At this time the ISE computer account is in the default computer OU and the ISE service account is in the.
After removing and re-adding and double checking the groups (External Identity Stores > Groups) both SIDs match on both domain users group
When I connect to the SSID I initially get prompted for a username and password then –
The BYOD Portal splash page just says BYOD Welcome “Unable to obtain the user information needed for access. Try again. (If I use a standard user account member of “domain users” only BUT if I use my domain admin account when joining the SSID (member of domain users + domain admin) I can start the process or registering my device and I can proceed through the required steps 1,2,3,4 until I access the web
Standard “domain user” I can’t get by step 1 as I get the “Unable to obtain the user information needed for access. Try again” message
The boss says this SSID is stripped back to just domain users and asks the question why does domain admins work??  - Hence Server AD getting a finger pointed at it.
Regards
James
I have uploaded some picts that may assist & thanks again.