We have a Cisco ISE 2.0 in our lab doing some 802.1X testing. To have synchonized times, we use an NTP server in the same subnet as the ISE to sync all the components (stratum 3, based on Bluecat appliances). All switches, firewalls and other components use it as timezone and it works.
I configured the same NTP server on my Cisco ISE, but even after multiple restarts it does not use it as NTP source.
ise/admin# sh run | i ntp ntp server 18.104.22.168 ntp server 22.214.171.124 ise/admin# sh run | i timezone clock timezone CET ise/admin# sh ntp Configured NTP Servers: 126.96.36.199 188.8.131.52 synchronised to local net at stratum 11 time correct to within 11 ms polling server every 64 s remote refid st t when poll reach delay offset jitter ============================================================================== *127.127.1.0 .LOCL. 10 l 16 64 377 0.000 0.000 0.000 184.108.40.206 220.127.116.11 3 u 51 64 377 0.221 134683. 21473.0 18.104.22.168 22.214.171.124 2 u 41 64 377 3.941 142841. 14340.1 * Current time source, + Candidate , x False ticker Warning: Output results may conflict during periods of changing synchronization.
Both of them are reachable (the first one even in the same subnet), as can be also seen at the delay / jitter values. Interestingly the offset differs quite significant looking at both time servers. The offset however is roughly correct, slightly more than 2 minutes. As I do not have access to the root shell, I cannot use ntpq as indicated by this tech note. Additionally, as far as I know, none of both sersers is a Microsoft NTP.
Just to make sure it is not an NTP server issue, I configured one of our Cisco routers as NTP server, which itself uses 126.96.36.199. ISE recognizes it as stratum 4 server, but does not choose it as time source.
Any hints how to tackle this one?