[Lesson Learned] Changing Name Server on Cisco ISE 1.2 Deployment

If you ever experience DNS resolution failure on Cisco ISE with Active Directory integration, it could lead to AD being disconnected, and every authentication against AD will be dropped (RADIUS Request Dropped).

Here are the captured image from the DNS resolution failed alarms:

We need to make sure that ISE can ping to DNS server and change the name server to that DNS.
It could be a little bit tricky as we need to remove the DNS 1 and (if any) DNS 2 before add the name server to the list. If we don’t do that first, our new name server ip address will be placed last in the list, which means ISE will query the first name server before reaching next name servers. We can add up to 3 DNS servers into ISE deployment. So here are the steps:
Check the name server configured on ISE with command “show run | in name-server”

Then we need to remove the name servers configured. If we just want to add the third name server, we don’t need to remove the first two name servers.

Do not restart ISE, we will restart ISE after we provide the correct name servers

After that, ISE will restart. Restart duration depends on the hardware resources allocated for ISE. To verify all processes are running well after restarting, we can check with command “show application status ise”. During restart process, we can ping the server, but because ISE Application Server is not running, we cannot access the ISE GUI until it is running.

Make sure the name server is already changed to the correct ones.