topic ISE NTP Time Source in Network Access Control

ISE NTP Time Source

PutmanoAIT — Wed, 28 Mar 2018 06:59:44 GMT

I have implement Cisco ISE as TACACS server, I configured NTP point to my AD server for time synchronization. Unfortunately ISE always select LOCAL(*127.127.1.0) as a time source. Does we have any configuration to force the ISE to sync time with AD? Thank for your kindly support.

Re: ISE NTP Time Source

bijin bharathan — Wed, 28 Mar 2018 07:26:01 GMT

Hi,

Below Technote should help you.

Troubleshoot ISE and NTP Server Synchronization Failures on Microsoft Windows - Cisco

Re: ISE NTP Time Source

PutmanoAIT — Wed, 28 Mar 2018 07:40:20 GMT

Hi bbharathan,

How can I get into Cisco ISE root level?

Thanks.

Re: ISE NTP Time Source

Jason Kunst — Wed, 28 Mar 2018 12:19:14 GMT

We don’t let you into root level.

I would recommend making sure your NTP source is a good one per the document

Tac can assist in troubleshooting

Re: ISE NTP Time Source

hslai — Thu, 29 Mar 2018 05:51:47 GMT

It seems to me the main issue is that your AD servers are both of Stratum 16. Clock_strata explains that

... The upper limit for stratum is 15; stratum 16 is used to indicate that a device is unsynchronized. ...

Please check on support documents on Microsoft servers for troubleshooting. For example,

[2018-Mar-29] Looking at it again, I think your AD servers are not responding to NTP requests from ISE, because the column "reach" showing 0. Please troubleshoot that issue first.