300-715 · Question #72
If there is a firewall between Cisco ISE and an Active Directory external identity store, which port does not need to be open?
The correct answer is C. TCP 21. For Cisco ISE to integrate with Active Directory, ports for LDAP, Kerberos, SMB, and NTP are required, but FTP (TCP 21) is not used for this integration.
Question
If there is a firewall between Cisco ISE and an Active Directory external identity store, which port does not need to be open?
Options
- AUDP/TCP 389
- BUDP123
- CTCP 21
- DTCP 445
- ETCP 88
How the community answered
(42 responses)- A2% (1)
- B7% (3)
- C88% (37)
- D2% (1)
Why each option
For Cisco ISE to integrate with Active Directory, ports for LDAP, Kerberos, SMB, and NTP are required, but FTP (TCP 21) is not used for this integration.
UDP/TCP 389 is used for LDAP (Lightweight Directory Access Protocol) communication, essential for ISE to query Active Directory.
UDP 123 is used for NTP (Network Time Protocol), crucial for time synchronization between ISE and Active Directory to prevent Kerberos-related authentication issues.
TCP 21 is the standard port for the File Transfer Protocol (FTP), which Cisco ISE does not use to communicate with Active Directory for authentication or identity management purposes.
TCP 445 is used for SMB (Server Message Block) and Netlogon services, often involved in Active Directory communication and machine account management by ISE.
TCP 88 is used for Kerberos, the primary authentication protocol within Active Directory, which ISE uses for secure communication and user authentication.
Concept tested: Cisco ISE-Active Directory required firewall ports
Source: https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/admin_guide/b_ise_admin_guide_26/b_ise_admin_guide_26_chapter_01001.html#concept_3C1D069B565C419C9FB33B7651817C8A
Topics
Community Discussion
No community discussion yet for this question.