ISE Local Time

[Mady]

Hi,

I would like to seek your help with our ISE time settings. We have 2-node deployment we upgraded it  toversion 2.1. After we upgraded the ISE we encountered issue with NTP. Both primary and secondary nodes are not in synch with NTP. 

Both primary and secondary nodes have same local time however, we encounter issue with the secondary, it keeps on disjoining to Active Directory. We need to manually adjust the time to atleast 1 minute advance on current time of primary ISE for it to successfully joined on AD.

Can you help me understand why does the secondary ISE always disjoin with our AD even they have same time (local time) with primary ISE. We don't encounter the clock skew error with our primary ISE.

And what are the possible reasons why ISE local time change?

Thank you for your help! :)

Regards,

Mady

[Mohammed al Baqari]

Hi,

Cisco best practice is to have AD and ISE syncing with same time server as this is known issue. Is your secondary ISE consistently synched with ISE

[Mady]

yes, secondary ISE is synched. I opened a TAC case and the engr accessed the root to  modify the ntp config but it is just a workaround. I'm still waiting for the resolution from dev team.