2

I'm unable to join ISE to the Windows domain. I tried using an admin account that I login to ISE. The first error stated that the username and password was incorrect. So I created an admin account in AD, and made it a domain admin. Now when I attempt to join it to the domain in ISE, I get a new error stating 'Failed to find domain controller in domain, there is no available DC's'. This is in the detailed logs, but the name of the error is LW_ERROR_CLOCK_SKEW. Error code 40087

I can ping the domain controller from ISE, and I can ping ISE from the domain controller. The time is synced correctly between ISE and the NTP source, which is the core switch.

Improve this question
9
  • What's the ISE's DNS setup? DNS is required to find a DC. – Zac67 Sep 10 '17 at 7:32
  • I have the ip name-server defined in the ISE config. And I have a Host A record configured for ISE, along with a PTR. – duckengineer Sep 10 '17 at 8:11
  • DNS needs to point to Windows DNS, complete with DC records. Additionally, the LW_ERROR_CLOCK_SKEW might indicate asynchronous time between ISE and DC - I suspect that an offset larger than x prevents login. Take a look at the timezones as well. – Zac67 Sep 10 '17 at 8:27
  • Correct Zac67, but as I stated in my post I've already covered those bases and verified. DNS does indeed point to Windows DNS, all DC records exist accordingly, and the time and timezone are correct. The time is literally about 3 seconds off. – duckengineer Sep 10 '17 at 8:34
  • 3 seconds? If they're synced they should be the same. – Ron Trunk Sep 10 '17 at 13:19
2

If your ISE server's clock is not synchronized with the Active Directory DC, then authentication can fail. This is because AD is using Kerberos auth with timestamped tickets. You've stated your ISE is synched with the core switch, but what does the DC also sync with that NTP source?

Also, you mention you gave Domain Admin privileges to the service account you created. This is likely way too high a privilege level for this account. You should reference the ISE documentation for the needed permissions. But from my experience a standard user account should suffice.

ISE 2.0 AD Integration Guide

Improve this answer
1
  • Yes, I agree it's way to high and we'll pull that back. That was just for testing purposes. The DC is also using the same NTP source. – duckengineer Sep 10 '17 at 16:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.