The operation took longer than expected.

[Jason2005]

I have just synchronized both Active Directory and Cisco ISE, ISE is using my server (AD) as an NTP server, everything is fine, but now I'm facing an issue "Status Summary: The operation took longer than expected. This may be caused by slow network connection or similar issues. Please check the connection tab status table and the AD Connector Report for details."

I could not understand the thing that is causing this issue.

Cisco ISE could resolve DNS names on server.

======> Only problem I could have and I'm not sure that it is the thing that is actually causing the issue is that my Windows Server clock is one hour forward Cisco ISE (They both have 1 hour difference in their clocks) despite that Cisco ISE is using my Windows Server as an NTP server.

=======> Please see attached image.

CiscoISE - Profiling [MAB] 

CiscoISE: Bug Search Tool におけるpatch番号の読み方 

CiscoISE policy applying on switch problem 

[marce1000]

             - Make sure that ISE has active and correct PTR records (DNS) , for the AD nodes , 

 M.

[Jason2005]

How could I check this? I do have a reversed zone, my windows server has an internal address of 192.168.50.2 and goes out to the internet with a 192.168.99.36 address, ISE have an address of 192.168.99.35, ISE does resolve names on my windows server.

On my Reversed DNS Zone, I have setted both 50.168.192.in-addr.arpa and 168.192.in-addr.arpa for global address.

Am I missing something ?

[marce1000]

                            >...Am I missing something ?
  - At first glance not ,other causes may be involved ; you can for instance check PTR records  with https://www.whatsmydns.net/
 yet this may not work  for private addresses , 

 M.
 

[Jason2005]

Some guys told me to do a reboot for ISE Node in order to get it synchronized.

But I'm afraid of losing data when rebooting Cisco ISE Node.

Shall I use the command STOP APPLICATION ISE then type the command HALT in order to save configuration?

Or does making a direct REBOOT will work ?

[Aref Alsouqi]

Hi Jason,

You mentioned that ISE and the AD have a time skew of an hour? if that is the case then this issue is most likely caused by that. If ISE has a time skew more than 5 minutes it would not be able to join the AD.

Regarding rebooting ISE, when you issue the command to reboot it, it would ask you if you want to save any unsaved configs. The  recommended steps would be "application stop ise" and then "reload". The "halt" command would be used if you want to shutdown ISE rather than reloading it.

[Jason2005]

I tried to set Windows Server clock manually (Cause I can't set it from ISE, reason is PATCH), but actually when trying to make the difference in time smaller, on the ISE GUI it shows a SKEW_ERROR.

[Aref Alsouqi]

You don't necessarily have to point ISE time to your domain controller, you can use any trusted public NTP server if you want. Try please to use a different NTP server on ISE, and once the time is in sync on both ISE and the AD ISE should join the AD just fine.

[thomas]

@Jason2005 , Why are you linking to these other unrelated community articles and documents?

[thomas]

@Jason2005 , Why are you linking to these other unrelated community articles and documents?

[Jason2005]

@Aref Alsouqi Could that be ever related to Cerficate Authority ?

[Aref Alsouqi]

I don't think so because ISE doesn't rely on certificates to join the AD.

[Jason2005]

@Aref Alsouqi So I don't get it why he woldn't join

Please guys any solutions. 

Please I need your help.

[MHM Cisco World]

If there are two endpoint one fast and other slow 

Then share the live log detail for both.

I have something in my mind and need to check

MHM

[Aref Alsouqi]

Did you fix the time skew issue between ISE and the AD? if not, that would most likely be the reason.

[Jason2005]

Cisco ise is not showing any skew error but I have a Time Out Error.