ISE NTP Time Source

[PutmanoAIT]

I have implement Cisco ISE as TACACS server, I configured NTP point to my AD server for time synchronization. Unfortunately ISE always select LOCAL(*127.127.1.0) as a time source. Does we have any configuration to force the ISE to sync time with AD? Thank for your kindly support.

[bijin bharathan]

Hi,

Below Technote should help you.

Troubleshoot ISE and NTP Server Synchronization Failures on Microsoft Windows - Cisco

[PutmanoAIT]

Hi bbharathan,

How can I get into Cisco ISE root level?

Thanks.

[Jason Kunst]

We don’t let you into root level.

I would recommend making sure your NTP source is a good one per the document

Tac can assist in troubleshooting

[hslai · Accepted solution]

It seems to me the main issue is that your AD servers are both of Stratum 16. Clock_strata explains that

... The upper limit for stratum is 15; stratum 16 is used to indicate that a device is unsynchronized. ...

Please check on support documents on Microsoft servers for troubleshooting. For example,

• How to configure an authoritative time server in Windows Server
• Support boundary to configure the Windows Time service for high-accuracy environments

[2018-Mar-29] Looking at it again, I think your AD servers are not responding to NTP requests from ISE, because the column "reach" showing 0. Please troubleshoot that issue first.