Distirbtued ISE 1.3 timezones

Question

Question about timezones in ISE 1.3 for distributed deployments across the globe. I've seen some comments/recommendations on not configuring timezone on ISE nodes when deploying in dispersed geography and just leaving timezone as UTC. I've even seen that supposedly it's not allowed to change timezone after installation.
Is this an outdated recommendation that doesn't apply to ISE 1.3 anymore?
Should I use the same UTC timezone on all ISE nodes? How do admins deal with reading logs in this environment? I can see how tricky it can be to analyze. What about guest provisioning in sponsor portals, won't it be confusing for sponsors when setting time periods for guest accounts? What about Active Directory sync, is it ok if the ISE PSN's timezone doesn't match AD server's timezone?

Answer 1

Hi Kevin-
A couple of questions/suggestions:
- Is there a chance that the students are also part of the employee AD group? I know it is a silly question but I must ask :) In fact, when a successful authentication happens, you can open the "detailed authentication screen" for that session and you can see all of the AD groups that the user is member of
- Have you tested this yourself? For instance, you can create a test account in each group and then try it for yourself
- Another silly question but can you confirm that each SSID has a unique interface in the WLC, thus going to a different subnet/DHCP scope
- I would make your authorization rule a bit simpler. I would like you to remove the: 
"AD1:ExternalGroups NOT_EQUALS mydomain/Students/All Students"
When it comes to AD groups, ISE would process them in a "top-down" fashion and as soon as a match occurs, ISE would stop looking. I don't think this is the issue in your case but still worth the try. 
- If the main issue is lack of DHCP addresses then why not address that? :) For instance, you can:
1. Expand the DHCP scope (From let's say /24 to a /23)
2. Assign a "secondary IP" address to the L3 interface, thus giving it more subnets
3. Utilize "Interface Groups" in the WLC, that way you can have multiple subnets tied to the same SSID
Thank you for rating helpful posts!