topic Re: ISE Time Source Issue in Network Access Control

ISE Time Source Issue

PutmanoAIT — Fri, 21 Feb 2020 18:52:09 GMT

I have implement Cisco ISE as TACACS server, I configured NTP point to my AD server for time synchronization. Unfortunately ISE always select LOCAL(*127.127.1.0) as a time source. Does we have any configuration to force the ISE to sync time with AD? Thank for your kindly support.

Re: ISE Time Source Issue

Marvin Rhoads — Wed, 28 Mar 2018 12:18:28 GMT

The refid ".INIT." and st (stratum) 16 indicates that for whatever reason the ISE server is not getting any NTP synchronization from the AD servers. In such a situation, it will fall back to localhost as the time source.

I'd do a packet capture at each end and see if

a. the ntp requests arrive on the AD servers and

b. if any responses arrive at the ISE server.

Re: ISE Time Source Issue

ajc — Wed, 28 Mar 2018 19:55:17 GMT

In case you are using Windows as NTP Server. Please check the following.

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/119371-technote-ise-00.html