ISE 1.2 Time Zone

[ahurtadove]

Hi Community!!

I have a ISE 1.2 pair, v9 patch installed and sychronized. Recently our time zone changed to summer time which is one hour later. In the CLI I can see that the reference is sent by NTP and the clock has changed but in monitoring I can still see that there is an hour difference from real time.

I read in Cisco official documentation that time cannot be changed on ISE or else it will become unusable but the logs are not being timestamped correctly and also the time the RADIUS request are made by NAD vs the time they are recieved by ISE have one hour difference.

Is there a way to solve this? it seems to be prone to any kind of unexpected behaviour when we are least expecting it.

Thank you!!

[nspasov · Accepted solution]

You are correct about being able to change the timezone in CLI. If you do that TAC will not support the product anymore if any odd issues are to arise. With that being said, I have changed the timezone before and the system continued to work as expected without any issues. :) So I will leave it up to you on how you would proceed. The only other option is to re-image the nodes. 

I hope this helps!

Thank you for rating helpful posts!

[ahurtadove]

Thank you Neno, I actually have those ISE in HA synched with an NTP server, the thing is that the CLI shows the correct time but the GUI doesn't and since that moment I have not been able to capture system summary correctly in the dashboard, so no CPU, memory or auth latency is showing. What makes this so interesting is that it has been happening on two different ISE deployments.

[nspasov]

So:

1. What timezone do you have configured in CLI right now?

2. What timezone do you see configured in the GUI (It will be grayed out so you can't change it)

3. What is the actual timezone that you want to have configured and do you want to observe daylight savings

Thank you for rating helpful posts!

[ahurtadove]

1. CLI: Chile/Continental showing the correct time with daylight saving (as it changed last week and given by NTP)

2. GUI: Chile/Continental showing time with one hour behind

3.  Chile Continental, and daylight saving changed last saturday.

[nspasov]

Hmm, this is very strange and it almost seems like a bug with ISE. I would recommend that you contact TAC and have them check this out. 

The reason I think that it is a bug (Related to the timezone) is the fact that the base OS (Cent/ADE OS) appears to be running fine and keeping track of DST (Day light savings) but the actual application (ISE) installed on Cent is not. 

I am far from NTP or Linux expert but I don't believe that NTP pushes/honors timezones. I think NTP just synchronizes the clock while timezones/DST is controlled locally. 

If the issue is not a bug, it is perhaps due to selecting the incorrect timezone. I have never done a deployment outside of the US and the UK so I am not familiar with timezones in Chile. However, if we take Eastern Time Zone for example. I had to make sure that I select "EST5EDT" in ISE and not just EST. If I simply selected EST then DST was not observed and made things ugly :) The same applied for Pacific timzone where I had to make sure that I select "PST8PDT" With all of that being said, I checked the CLI in ISE and I don't see any Chile related timezones that would indicate DST observations. You can check for those yourself by using the following command "show timezones"

I was able to find these but perhaps there are more and a specific one to CST/CLST. I tried searching for those but could not find anything:

NS-ISE-01/admin# show timezones | i Santiago
America/Santiago

NS-ISE-01/admin# show timezones | i Chile
Chile/EasterIsland
Chile/Continental

NS-ISE-01/admin# show timezones | i CLT

!

NS-ISE-01/admin# show timezones | i CLST

Let me know what you find. I would like to know the cause/resolution

Thank you for rating helpful posts!

[ahurtadove]

So yes, after opening a TAC case and receiving a NO as an answer and saying that changing the timezone is not supported (as stated here) I went ahead and changed the timezone to one that matched the NTP hour. So I did, restarted the app et voilá. Everything started working again as it should.

[nspasov]

Which timezone did you have to select that was for Chile with day-light-savings? I couldn't locate one in ISE when I was previously trying to help?

Also, if your issue is resolved you should mark your thread as closed ;)

Thank you for rating helpful posts! 

[ahurtadove]

I used America/Argentina/Buenos_Aires which is the same as GMT -3

[nspasov]

Awesome! Thanks for sharing (+5) from me.

[Saurav Lodh]

Yes that's true, it would be unusable

Changing time zone impacts different Cisco ISE node types in your deployment as follows:

Standalone or Primary ISE Node

Changing the time zone after installation is not supported on a Standalone or Primary ISE node. However, if you inadvertently change the time zone, do the following:

• Revert to the time zone back. (the time zone before it changed).
• Run the application reset-config ise command from the CLI of that node.
• Restore from the last known good backup before the time zone change on that node.

[jackmtl71]

Salodh, what do you mean by a Primary ISE node, PAN? (Primary Administration node)?

I am in a similar situation where I have a 2 node ISE deployment.

Node 1 is Primary PAN and secondary MNT

Node 2 is Secondary PAN and Primary MNT

I need to change timezone on node 2 from EST to EST5EDT.  If not supported on Primary PAN and standalone, could I make Node 1 Primary for both PAN and MNT, then change timezone on node 2?