Cisco ISE timezone change in ver 3.0

[fuhrersk8]

Hi Guys;

What is the correct procedure/order to change the timezone in a high-availability ISE deployment? 

This is for ISE 3.0 Patch 4.

Thanks for your support.

Regards,

[Marcelo Morais · Accepted solution]

Hi @fuhrersk8 ,

 once set, you are able to change the timezone ONLY on the CLI:

ise/admin# show timezone   >> to check your timezone
ise/admin# show timezones  >> to check the timezones
ise/admin# clock timezone timezone  >> to change  the timezone

Note: during the process, ISE restarts.

Hope this helps !!!

[fuhrersk8]

Thanks Marcelo;

The change should be performed first on the PRI(A) and then on the SEC(A) or it does not matter?

Thanks again.

Regards, 

[Volker Fries]

Hi together,

cisco docu ist not very clear on this point. In the Rel. 3.0 cli reference guide you find the following:

Changing the Time Zone on Cisco ISE Nodes

Changing the time zone on a Cisco ISE appliance after installation causes the Cisco ISE application on that node to be unusable. However, the preferred time zone (default UTC) can be configured during the installation when the initial setup wizard prompts you for the time zones.

Changing time zone impacts different Cisco ISE nodes types of your deployment.

To recover from the impact, use the following steps:

Standalone or Primary Cisco ISE Node

To change the timezone after installation you must re-image the node.

Ensure that you have a backup of latest configuration, and export the necessary certificates and keys.

If you wish to change the time zone, do the following:

• Re-image the Primary Cisco ISE node.

• During the installation, select the appropriate timezone.

• Restore backup and certificates.

• Rejoin Active Directory and apply any per-node configurations for ISE profiling probes, LDAP,etc.

Secondary ISE Node

If you want to change the time zone on the secondary node to keep it to be the same as the primary node, do the following:

• Export the necessary certificates.

• Deregister the secondary node.

• Re-image the node.

• Import the necessary certificates, if required.

• Re-register the node as a secondary node to the primary node.

• Rejoin Active Directory and apply any per-node configurations for ISE profiling probes, LDAP,etc.

https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/cli_guide/b_ise_cli_reference_guide_30/b_ise_CLIReferenceGuide_30_chapter_011.html#wp4256051829

so what is correct now ????

do I need to re-image or not ?

what is affected ? certs , pxgrid ?

[Naresh Ginjupalli]

Re-Image is no longer needed on ISE when Timezone is changed. ISE services will go for restart and you are good to go with the new Timezone.

As per ISE Document here is the info :

Changing the time zone on the PSN or MnT nodes of a Cisco ISE appliance after installation, causes some known issues with the sorting order of the live logs and live sessions pages. The old logs and sessions are not displayed in the right sorting order based on timestamps. New sessions created after the time zone change are sorted and displayed in the right order. ISE reports may also have data inconsistencies in the timestamp fields and incorrect sorting order.

ISE 3.0 Link : https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/cli_guide/b_ise_cli_reference_guide_30/b_ise_CLIReferenceGuide_30_chapter_011.html#wp4256051829

ISE 3.4 Link : https://www.cisco.com/c/en/us/td/docs/security/ise/3-4/cli_guide/b_ise_CLI_Reference_Guide_34/b_ise_CLIReferenceGuide_chapter_01.html?bookSearch=true

[c-davies]

conf t

clock timezone timezone 

[Marcelo Morais]

Hi @c-davies ,

 yes, exactly ... thanks:

ise/admin# configure terminal 
ise/admin(config)# clock timezone timezone

Regards

[fitzie]

clock timezone is not a valid command on v3.0p4 running on a SNSS 3655
ise-prod-2/admin# clock timezone America/New_York

                                       ^
% invalid command detected at '^' marker.

You have to enter config mode.

[ahollifield]

config t