Replacing AD servers in a network with ISE

[BoomShakaLak]

The server team will be replacing the existing AD servers with new ones shortly.  The new servers have been added to the network using new hostnames and IPS and will live side by side the old servers until everything else is confirmed OK at which point the old servers will be turned off.  The new servers will then have their IPs updated to that of the old servers.  These servers are also the DNS servers for the network.

I currently do not see these new AD servers in the External Identity Sources list which leads me to believe that the AD controller discovery only happens upon joining the ISE to the AD domain.  Is this true?  And since these servers will inheret the old server IPs eventually, will there be a need to actually do anything on the ISE side?

Would I have to Leave the AD domain and join the ISE back to it?  If so, what are the consequences of doing so?  Will all rules that reference AD groups need to be recreated?

Any other Gotcha's?

[Milos_Jovanovic · Accepted solution]

Hi @BoomShakaLak,

ISE is relying on AD Sites and Services and standard AD integration, same (or quite similar) as any other domain joined PC. This means that ISE is capable of discovering DC servers simply based on domain name and whatever magic happens in the backend. You don't have any specific IPs, because you used only domain name during integration, where ISE discovered DC servers automatically, based on DNS entries.

For as long as server team do their part ok and inherit everything, there is nothing you need to do. ISE will discover those servers and will continue talking to them. No AD leave/join action should be required as ISE creates machine account under AD upon join, and uses machine credentials to communicate to AD afterwards. With migration, this account should be unaffected, thus no need to do anything from your end.

Kind regards,

Milos