Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Support for external DNS and NTP servers #12

Open
1 task done
bando483 opened this issue Jul 18, 2024 · 10 comments
Open
1 task done

Support for external DNS and NTP servers #12

bando483 opened this issue Jul 18, 2024 · 10 comments
Assignees
@sudhanss
Labels
bug Something isn't working good first issue Good for newcomers

Comments

@bando483
Copy link

Is there an existing issue for this?

  • I have searched the existing issues

Description

Hi
I'm working with terraform /python scripts to deploy an full ISE environment but I have a private DNS and Domain controller server so I would like to not use Route53 but instead rely on my Active Directory. I have some questions for this:
1- if I comment / unuse the whole Route53 module is the deployment expected to work? Actually terraform deploy ended successfully and state machine function as well but PSN and Secondary Pan seems not registered to primary PAN.
2- I need to set 2 DNS server but the script foresees just to set a single primarynameserver; how can I set a second one?
3- same question for bullet 2, but regarding ntp server.

thanks
Alessio

New or Affected Resource(s)/Data Source(s)

NEW

Potential ISE Automation Configuration

could something like the followings in userdata.tftpl  work?

primarynameserver=${primarynameserver}
secondarynameserver=${secondarynameserver}
primaryntpserver=${primaryntpserver}
secondaryntpserver=${secondaryntpserver}
@bhadeshp
Copy link
Contributor

Hi @bando483 - Thanks for reaching out, we are checking this and will get back to you

@sudhanss
Copy link

Hi Alessio (@bando483),

To debug this further could you please confirm below points -

1- Is the state machine execution successful?
2- If you have used your private DNS, could you please confirm if the same got configured during ISE installation? To check this you can execute show running-config in all ISE nodes and look for “ip name-server” and “ntp server“.
3- Please confirm is DNS is reachable from all ISE nodes and DNS has correct hosts entries as per installed ISE nodes with correct IPs and deployed ISE nodes are able to resolve other ISE nodes FQDN?
4- Could you please also share Primary Admin node Deployment page UI screen capture?

Please note when we use terraform script to deployment ISE cluster with New VPC, ISE nodes are deployed in Private subnet, where configuring private DNS reachability before deployment starts is not possible until we monitor terraform execution and update VPC/Private subnet to reach to private DNS, so even if terraform execution succeeds, deployment formation will fail.

If we use these script to deploy ISE cluster in existing VPC then Deployment will be successful. (Provided right DNS/NTP are configured in ISE nodes, refer point#2)

As of now till Cisco ISE release 3.3, multiple DNS/NTP in cloud is not supported, We have this feature coming up in Cisco ISE release 3.4 and accordingly terraform scripts and README will be updated to use the same.

Thanks & Regards,
Sudhanshu

@bando483
Copy link
Author

Hi

thank for the feedback on multiple DNS/NTP.. i'm gonna wait for next release.

regarding the error, I confirm reachability of DNS is present but I noticed an issue on DNS entries, so I guess this is why the nodes have not been registered. could it be?

by the wait, the state machine ended successfully even though the nodes are not registered and I guess this is a bug since I expected a failure of STate Machine

regards
Alessio

@sudhanss
Copy link

Yes, you are right. If DNS entries are not correct as per ISE deployed ISE nodes, then ISE Deployment node registration will fail.

however, if state machine executed shows success even after failed node registration, then it could be a possible bug. To confirm that could you please share state machine execution logs?

Thanks & Regards,
Sudhanshu

@bando483
Copy link
Author

bando483 commented Jul 25, 2024 via email

@bando483
Copy link
Author

bando483 commented Jul 26, 2024 via email

@sudhanss
Copy link

I do not see screen capture here Alessio(@bando483 ), Could you please help me with the cloudwatch logs for failed state to debug the issue.

@sudhanss
Copy link

sudhanss commented Jul 28, 2024 •
edited
Loading

Update - I am able to reproduce the issue where Step Function work flow succeeds even if node registration fails. This is a bug in code , we will fix it by enhancing error Handling for register node state.
Please note this do not impact positive flow. In above scenario as DNS was bot reachable from ISE nodes, deployment register node failed however the same was not reflecting in step function state due to missing error handling.

@sudhanss sudhanss added bug Something isn't working good first issue Good for newcomers labels Jul 28, 2024
@bando483
Copy link
Author

bando483 commented Jul 28, 2024 via email

@sudhanss
Copy link

Fix is in progress, we will update once changes are merged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@sudhanss sudhanss

Labels
bug Something isn't working good first issue Good for newcomers
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@sudhanss @bando483 @bhadeshp