topic Re: The operation took longer than expected. in Network Access Control

The operation took longer than expected.

Jason2005 — Tue, 23 Apr 2024 17:55:50 GMT

I have just synchronized both Active Directory and Cisco ISE, ISE is using my server (AD) as an NTP server, everything is fine, but now I'm facing an issue "Status Summary: The operation took longer than expected. This may be caused by slow network connection or similar issues. Please check the connection tab status table and the AD Connector Report for details."

I could not understand the thing that is causing this issue.

Cisco ISE could resolve DNS names on server.

======> Only problem I could have and I'm not sure that it is the thing that is actually causing the issue is that my Windows Server clock is one hour forward Cisco ISE (They both have 1 hour difference in their clocks) despite that Cisco ISE is using my Windows Server as an NTP server.

=======> Please see attached image.

Re: The operation took longer than expected.

Mark Elsen — Wed, 24 Apr 2024 06:19:43 GMT

- Make sure that ISE has active and correct PTR records (DNS) , for the AD nodes ,

Re: The operation took longer than expected.

Jason2005 — Wed, 24 Apr 2024 08:02:36 GMT

How could I check this? I do have a reversed zone, my windows server has an internal address of 192.168.50.2 and goes out to the internet with a 192.168.99.36 address, ISE have an address of 192.168.99.35, ISE does resolve names on my windows server.

On my Reversed DNS Zone, I have setted both 50.168.192.in-addr.arpa and 168.192.in-addr.arpa for global address.

Am I missing something ?

Re: The operation took longer than expected.

Mark Elsen — Wed, 24 Apr 2024 08:28:39 GMT

>...Am I missing something ?
- At first glance not ,other causes may be involved ; you can for instance check PTR records with https://www.whatsmydns.net/
yet this may not work for private addresses ,

Re: The operation took longer than expected.

Jason2005 — Wed, 24 Apr 2024 08:32:46 GMT

Some guys told me to do a reboot for ISE Node in order to get it synchronized.

But I'm afraid of losing data when rebooting Cisco ISE Node.

Shall I use the command STOP APPLICATION ISE then type the command HALT in order to save configuration?

Or does making a direct REBOOT will work ?

Re: The operation took longer than expected.

Aref Alsouqi — Wed, 24 Apr 2024 08:38:38 GMT

Hi Jason,

You mentioned that ISE and the AD have a time skew of an hour? if that is the case then this issue is most likely caused by that. If ISE has a time skew more than 5 minutes it would not be able to join the AD.

Regarding rebooting ISE, when you issue the command to reboot it, it would ask you if you want to save any unsaved configs. The recommended steps would be "application stop ise" and then "reload". The "halt" command would be used if you want to shutdown ISE rather than reloading it.

Re: The operation took longer than expected.

Jason2005 — Wed, 24 Apr 2024 08:42:00 GMT

I tried to set Windows Server clock manually (Cause I can't set it from ISE, reason is PATCH), but actually when trying to make the difference in time smaller, on the ISE GUI it shows a SKEW_ERROR.

Re: The operation took longer than expected.

Aref Alsouqi — Wed, 24 Apr 2024 10:21:09 GMT

You don't necessarily have to point ISE time to your domain controller, you can use any trusted public NTP server if you want. Try please to use a different NTP server on ISE, and once the time is in sync on both ISE and the AD ISE should join the AD just fine.

Re: The operation took longer than expected.

thomas — Wed, 24 Apr 2024 15:20:38 GMT

@Jason2005 , Why are you linking to these other unrelated community articles and documents?

Re: The operation took longer than expected.

Jason2005 — Thu, 25 Apr 2024 06:45:56 GMT

@Aref Alsouqi Could that be ever related to Cerficate Authority ?

Re: The operation took longer than expected.

Aref Alsouqi — Thu, 25 Apr 2024 08:56:58 GMT

I don't think so because ISE doesn't rely on certificates to join the AD.

Re: The operation took longer than expected.

Jason2005 — Thu, 25 Apr 2024 10:09:21 GMT

@Aref Alsouqi So I don't get it why he woldn't join

Please guys any solutions.

Please I need your help.

Re: The operation took longer than expected.

MHM Cisco World — Thu, 25 Apr 2024 10:12:05 GMT

If there are two endpoint one fast and other slow

Then share the live log detail for both.

I have something in my mind and need to check

MHM

Re: The operation took longer than expected.

Aref Alsouqi — Thu, 25 Apr 2024 10:50:22 GMT

Did you fix the time skew issue between ISE and the AD? if not, that would most likely be the reason.

Re: The operation took longer than expected.

Jason2005 — Thu, 25 Apr 2024 14:24:14 GMT

Now I'm having failed to login error!

Re: The operation took longer than expected.

Jason2005 — Thu, 25 Apr 2024 14:25:39 GMT

Cisco ise is not showing any skew error but I have a Time Out Error.

Re: The operation took longer than expected.

MHM Cisco World — Thu, 25 Apr 2024 14:40:01 GMT

All this end to one point

Share live log details of failed endpoint

MHM

Re: The operation took longer than expected.

Aref Alsouqi — Thu, 25 Apr 2024 15:09:06 GMT

Just to make sure I'm following along, could you please share the screenshots of the errors you are referring to? and also, could you please confirm that both ISE and the AD are showing the right time?

Re: The operation took longer than expected.

Jason2005 — Fri, 26 Apr 2024 09:00:33 GMT

@MHM Cisco World

Here is logs for Cisco ISE.

I think it is something relative to AD Connector!