When time is accurate won't connect to AD

[shawn.pattison]

Recently we built up a new Cisco ISE 3.1.0.518 system.  We have 2 systems set as NTP servers. 

I set the timezone to Etc\UTC-4 (we are in Ohio) and when it syncs, the time is 8 hours off.  I.E. At 10:27am the system says the time is 18:28 (6:28pm).  Without making any changes and with the time incorrect I am able to connect ISE to our Active Directory Domain.  The NTP servers both have the correct time and time zone.

If I change the timezone to EST to match our old ISE server it fails to connect to the domain with "Error:  LW_ERROR_CLOCK_SKEW"

If I correct the time from 18:28 to 10:27am and try to connect to the domain.  It fails with "Error:  LW_ERROR_CLOCK_SKEW"

Why won't the ISE server connect to AD with the correct time and/or timezone?

[balaji.bandi]

check some document and tips :

Changing the Time Zone on Cisco ISE Nodes

https://www.cisco.com/c/en/us/td/docs/security/ise/3-1/cli_guide/b_ise_cli_reference_guide_31/b_ise_CLIReferenceGuide_31_chapter_011.html#wp3051495440

[shawn.pattison]

Thank you for the response but nothing in that document helps with this issue.  I still cannot connect to our local AD Domain unless the time on the ISE server is 8 hours out of sync.

[balaji.bandi]

To change the timezone after installation you must re-image the node.

[shawn.pattison]

For clarification: 

Are you saying that the ONLY way to change the time zone it to reinstall ISE?

So when I used the command 'clock timezone Etc\UTC-4' from 'conf t' it doesn't actually change the timezone on the server?

[shawn.pattison]

Follow up question:  If we reimage the node and then apply our backups to the new image, will that over write any changes that were made during the reimage process?

[Arne Bier]

Changing timezone in ISE does not require a re-image if you are using version 2.7 or greater.

If you restore a backup then you have the option of also restoring the ADE-OS - that's where the "show run" stuff is restored. You can say "no" to that option and then the existing Admin node's ADE-OS will remain untouched.

ise01/admin# show run | in time
clock timezone Australia/Sydney
--
  password-lock-timeout 15
--
cdp timer 60
cdp holdtime 180
ise01/admin# conf t
Enter configuration commands, one per line.  End with CNTL/Z.
ise01/admin(config)# clock timezone Australia/Queensland

% On ise distributed deployments, it is recommended all nodes be 
% configured with the same time zone. 
% Changing the time zone may result in undesired side effects
% Recommended to reimage the node after changing the time zone
Are you sure you want to proceed with time zone change?  Y/N [N]: Y
System timezone was modified. You must restart ISE for change to take effect.
Do you want to restart ISE now? (yes/no) yes

[balaji.bandi]

Changing timezone in ISE does not require a re-image if you are using version 2.7 or greater.

@Arne Bier thank you for the clarification, we using ISE 2.7, we could not able to achieve what you mentioned, so we have to re-image and set the time zone correctly, are you sure this was fixed in ISE 3.1 (since i was reading the ISE 3.1 document it says to re-image as per my experience this is the same case as ISE 2.7?

[Arne Bier]

Hello @balaji.bandi 

My previous example was taken from ISE 3.0 

But check this bug CSCvo49755 for more details on where it's supported.

"This functionality has been returned in ISE 2.2 patch 17, ISE 2.4 patch 11, ISE 2.6 patch 5, and ISE 2.7 patch 1"

I just tested it also on ISE 2.7 patch 6

It's quite insane that a timezone change should require a complete re-image.

Even the advice of how to set the timzeone in a deployment that spans multiple timezones always puzzled me - Cisco says "use UTC".   I have never done that. But perhaps I will. I just wasn't sure whether my Live logs would be in UTC, or would ISE convert the time based on my local time? If you have any system that spans multiple timezones, then the timezone offset is only of concern when relating it back to either your own timezone 9if it's different to others) or as a hard fact (e.g. a log file timestamp) of the system where the log is created. it's probably debateable.

If there is a good discussion on how this should be done and why, then I would be keen to hear it.

[balaji.bandi]

Thank you for sharing your experience and insight information,   just want to correct myself if my understanding was wrong.

yes my experience with 2.7 was same.

as per i know - UTC generally used if the ISE deployment geo location based that helps. but most of my installation and deployments with in the reason never looked it. but when you setup at intial setup all works as expected.

sure i am more intrested learn if anything new outcome here.

as Learning never ends...!

[shawn.pattison · Accepted solution]

The issue did turn out to be related to the timezone.  I originally had the time zone set to Etc/UTC -4 and the server time was 8 hours off.  I changed the timezone to Est like our old ISE server and the time was still off.  This morning I changed the timezone to US/Eastern and now the time is correct on the server and it connects to AD.

[balaji.bandi]

@shawn.pattison , that confirms we can cahnge Timezone with out re-image, thank you for your feedback and confirmation, appriciated.