topic Re: Alarms: configured nameserver is not responsive within timeout period in Network Access Control

Alarms: configured nameserver is not responsive within timeout period

Darkmatter — Fri, 10 Apr 2020 14:37:07 GMT

Every 90 minutes, i get this alarm. From both ISE nodes, pinging each other works just fine, so does DNS lookup, no problemo.

Configured nameservers are our domain controllers, again, you can ping them from ISE and DNS lookup is ok.

What is causing this recurring alarm?

Re: Alarms: configured nameserver is not responsive within timeout period

Mark Elsen — Fri, 10 Apr 2020 16:51:15 GMT

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvh02628/?rfs=iqvred

Re: Alarms: configured nameserver is not responsive within timeout period

Darkmatter — Fri, 10 Apr 2020 19:17:53 GMT

I came across that one already myself, but it doens't apply because i'm running 2.7

Affected releases are 2.1 and 2.2

Re: Alarms: configured nameserver is not responsive within timeout period

Mark Elsen — Sat, 11 Apr 2020 08:14:37 GMT

Tx, for giving feedback on your current ISE version being used , the bug report however is strikingly similar to what you are experiencing such as the 90 minute sequence period for the alarms being generated.. Do you also have 'unusable domains' as mentioned in the bug report (which apparently can trigger this problem) ?

Re: Alarms: configured nameserver is not responsive within timeout period

Darkmatter — Tue, 14 Apr 2020 21:07:45 GMT

What do you exactly mean with the 'bug report'? If you are referring to the detailed report of the error message, the answer is very short, there are not details available, it's just the error message.

So there is no real indication of something about 'unusable domains'.

Re: Alarms: configured nameserver is not responsive within timeout period

Anurag Sharma — Wed, 15 Apr 2020 07:28:24 GMT

Hi @Darkmatter ,

I think @Mark Elsen was talking about the Description, specifically the symptom of the bug. I checked the internal details on this bug. There are two possibilities:

(1) There is actually a DNS reachability issue at every 90 minutes interval.

(2) There is a regression of this bug in 2.7.

To check (1), you just need to take captures on ISE with the filter of the DNS server.

To check (2), check if you have any 'Unusable domains'. Refer to the image below:

Re: Alarms: configured nameserver is not responsive within timeout period

pierok — Thu, 16 Apr 2020 15:27:11 GMT

I just updated to 2.6 patch 6 and have the same issue now. But not every 90 minutes, every 75 minutes (just like you do)

No unusuable domain, no dns reachability issue because they are the same as before

Re: Alarms: configured nameserver is not responsive within timeout period

Anurag Sharma — Thu, 16 Apr 2020 18:12:50 GMT

Hi pierok,

From which version did you upgrade to 2.6 p6?

Re: Alarms: configured nameserver is not responsive within timeout period

pierok — Fri, 17 Apr 2020 06:56:55 GMT

from 2.3.
but now my Primary PAN is unresponsive....looks like I face a bug in patch 6 just like here : https://community.cisco.com/t5/network-access-control/ise-2-6-patch-4-deferred-removed/td-p/4037181
I'll revert back and install patch 5

Re: Alarms: configured nameserver is not responsive within timeout period

Darkmatter — Wed, 22 Apr 2020 13:59:03 GMT

I have to correct that i face this error also every 75 minutes and not 90 minutes like mentioned before.

I took a packet capture on one of the ISE nodes and the only abnormal i could see it this around the time that ISE reported the ALARM.

Installed patch 1 for version 2.7 - ise-patchbundle-2.7.0.356-Patch1-20033115.SPA.x86_64.tar.gz - in hopes this would be a bug and be solved by now but no luck either on that one.

FYI: ip addresses - .13/.14 are domain controllers and .49 is an ISE node - they are all in the same subnet

Re: Alarms: configured nameserver is not responsive within timeout period

Me And You — Mon, 04 Jan 2021 06:45:26 GMT

Running ISE 2.4 patch 11 same issue.

Running ISE 2.4 patch 13 same issue.

Running ISE 2.6 patch 6 same issue...

Re: Alarms: configured nameserver is not responsive within timeout per

ffischer — Tue, 19 Oct 2021 15:48:09 GMT

Same behavior here with ISE 3.0p4 in a 6 Node deployment
ADM(P) ADM(S) MnT(P) MnT(S) PSN1 PSN2)

PSN1 only reports
"Configured nameserver is not responsive within timeout period. Server is either busy or unreachable."

every 75 Minutes

No messages from PSN2.

Have the same two DNS Servers configured on all ISEs,

DNS Servers and ISEs are in in the same subnet...

Re: Alarms: configured nameserver is not responsive within timeout per

ajtm — Wed, 30 Mar 2022 07:18:27 GMT

Same issue here: Happens every 75 minutes on node 1 but node 2 is ok. Running ISE 3.0 patch 5.

Re: Alarms: configured nameserver is not responsive within timeout per

thomas — Tue, 12 Apr 2022 15:09:27 GMT

Consider contacting TAC to troubleshoot your issue - it the bug could have been re-introduced.

Re: Alarms: configured nameserver is not responsive within timeout per

magonzalez — Wed, 12 Jun 2024 01:52:06 GMT

Bringing this up as my last upgrade did not quiet the alarm...
I have a 10 node deployment... 5 redundant nodes... 2 PANs, 4 PSNs, 2 pxGRID and 2 M&T
My primary PAN always reports this 😞

My DNS is of course rock solid, or we would be having more than ISE errors 😉

Alarm Name : Configured nameserver is not responsive within timeout period. Details : Configured nameserver is not responsive within timeout period. Server is either busy or unreachable. Server=xxxPCSVIPAN01 Description : Configured nameserver is not responsive within timeout period. Server is either busy or unreachable. Severity : Warning Suggested Actions : Check DNS configuration, check corresponding DNS server and domain controller are available. Server is either busy or unreachable. *** This message is generated by Cisco Identity Services Engine (ISE) *** Sent By Host : xxxPCSVIMNT01

xxxPCSVIPAN01/admin#ping dns1 PING 10.80.5.110 (10.80.5.110) 56(84) bytes of data. 64 bytes from 10.80.5.110: icmp_seq=1 ttl=60 time=1.26 ms 64 bytes from 10.80.5.110: icmp_seq=2 ttl=60 time=1.03 ms 64 bytes from 10.80.5.110: icmp_seq=3 ttl=60 time=1.20 ms 64 bytes from 10.80.5.110: icmp_seq=4 ttl=60 time=0.800 ms --- 10.80.5.110 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3003ms rtt min/avg/max/mdev = 0.800/1.072/1.264/0.180 ms xxxPCSVIPAN01/admin#ping dns2 PING 10.161.20.110 (10.161.20.110) 56(84) bytes of data. 64 bytes from 10.161.20.110: icmp_seq=1 ttl=64 time=0.446 ms 64 bytes from 10.161.20.110: icmp_seq=2 ttl=64 time=0.160 ms 64 bytes from 10.161.20.110: icmp_seq=3 ttl=64 time=0.240 ms 64 bytes from 10.161.20.110: icmp_seq=4 ttl=64 time=0.167 ms --- 10.161.20.110 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3104ms rtt min/avg/max/mdev = 0.160/0.253/0.446/0.116 ms xxxPCSVIPAN01/admin#