Cisco Ise 13 User Guide

Diagnose Active Directory Problems
TheDiagnosticToolisaservicethatrunsoneveryCiscoISEnode.Itallowsyoutoautomaticallytestand
diagnosetheActiveDirectorydeploymentandexecuteasetofteststodetectissuesthatmaycausefunctionality
orperformancefailureswhenCiscoISEusesActiveDirectory.
TherearemultiplereasonsforwhichCiscoISEmightbeunabletojoinorauthenticateagainstActiveDirectory.
ThistoolhelpsensurethattheprerequisitesforconnectingCiscoISEtoActiveDirectoryareconfigured...

Obtain the Active Directory Log File for Troubleshooting
DownloadandviewtheActiveDirectorydebuglogstotroubleshootissuesyoumayhave.
Before You Begin
ActiveDirectorydebugloggingmustbeenabled.
Procedure
Step 1ChooseOperations>Troubleshoot>DownloadLogs.
Step 2ClickthenodefromwhichyouwanttoobtaintheActiveDirectorydebuglogfile.
Step 3ClicktheDebugLogstab.
Step 4Scrolldownthispagetolocatethead_agent.logfile.Clickthisfiletodownloadit.
Active Directory Alarms and Reports...

Active Directory Advanced Tuning
Theadvancedtuningfeatureprovidesnode-specificsettingsusedforsupportactionunderthesupervisionof
Ciscosupportpersonnel,toadjusttheparametersdeeperinthesystem.Thesesettingsarenotintendedfor
normaladministrationflow,andshouldbeusedonlyunderguidance.
Supplemental Information for Setting Up Cisco ISE with Active Directory
ForconfiguringCiscoISEwithActiveDirectory,youmustconfiguregrouppolicies,andconfigureasupplicant
formachineauthentication.
Configure Group Policies in Active...

PolicyProperties
Step 4ApplythepolicyatthedesiredorganizationalunitordomainActiveDirectorylevel.
Thecomputerswillreceivethepolicywhentheyrebootandthisservicewillbeturnedon.
Configure Odyssey 5.X Supplicant for EAP-TLS Machine Authentications Against Active Directory
IfyouareusingtheOdyssey5.xsupplicantforEAP-TLSmachineauthenticationsagainstActiveDirectory,
youmustconfigurethefollowinginthesupplicant.
Procedure
Step 1StartOdysseyAccessClient.
Step 2ChooseOdysseyAccessClientAdministratorfromtheToolsmenu....

Ifthisoptionisenabled,theOdysseysupplicantsendsthemachinenameintheformat
host\andActiveDirectoryidentifiestherequestascomingfromamachineandwill
lookupcomputerobjectstoperformauthentication.Ifthisoptionisdisabled,theOdysseysupplicant
sendsthemachinenamewithoutthehost\prefixandActiveDirectorywilllookupuserobjectsandthe
authenticationfails.
AnyConnect Agent for Machine Authentication
WhenyouconfigureAnyConnectAgentformachineauthentication,youcandooneofthefollowing:...

•IdentityMappingreport.ThisreportprovidesinformationabouttheIdentityMappingcomponentfor
troubleshooting
•IdentityMappingdebuglogs
•CiscoISEsessiondirectorymaintainsthecollecteduserinformation,sothatcustomerscanviewitfrom
theLiveSessionsandqueryitfromthepxGridinterface
•UsingtheCLIcommandshowapplicationstatusprovidesthehealthstatusofnodesthatuseIdentity
Mapping
•SupportsHighAvailability
Configuring Identity Mapping
IDMappingrequiresconfigurationinISE,andtheActiveDirectoryDomainServermusthavetheright...

ThistestensuresthattheconnectiontotheDCishealthy.HoweveritdoesnotcheckwhetherCiscoISEcan
fetchtheuserinformationuponlogin.
Step 8ClickSubmit.Anupdatedtableisdisplayedwiththenewly-definedDCincludedinthelistofDCs.The
statuscolumnindicatesthedifferentstatesofDC.
YoucanalsoImportorExporttheDClist.
Whileimporting,youneedtoprovidethepasswordinthetemplate.Asthefilecontainspassword,
theimporttemplateshouldbetreatedassensitive.TheExportoptiondoesnotexportthepassword.
Note
Filter Identity Mapping...

Anentryinthetreecontainsasetofattributes,whereeachattributehasaname(anattributetypeorattribute
description)andoneormorevalues.Theattributesaredefinedinaschema.
Eachentryhasauniqueidentifier:itsdistinguishedname(DN).Thisnamecontainstherelativedistinguished
name(RDN),whichisconstructedfromattributesintheentry,followedbytheDNoftheparententry.You
canthinkoftheDNasafullfilename,andtheRDNasarelativefilenameinafolder.
Multiple LDAP Instances...

IftheLDAPserverclosedtheconnection,theconnectionmanagerreportsanerrorduringthefirstcallto
searchthedirectory,andtriestorenewtheconnection.Aftertheauthenticationprocessiscomplete,the
connectionmanagerreleasestheconnection.
LDAP User Authentication
LDAPcanbeusedasanexternaldatabaseforCiscoISEuserauthentication.CiscoISEsupportsplainpassword
authentication.Userauthenticationincludes:
•SearchingtheLDAPserverforanentrythatmatchestheusernameintherequest...

◦Plainusernames
•SubjectsRefertoGroups—Thesubjectobjectscontainanattributethatspecifiesthegrouptowhich
theybelong.
LDAPidentitysourcescontainthefollowingparametersforgroupmembershipinformationretrieval:
•Referencedirection—Thisparameterspecifiesthemethodtousewhendetermininggroupmembership
(eithergroupstosubjectsorsubjectstogroups).
•Groupmapattribute—Thisparameterindicatestheattributethatcontainsgroupmembershipinformation.
•Groupobjectclass—Thisparameterdeterminesthatcertainobjectsarerecognizedasgroups....