Cisco ISE treats NTP as a consensus-driven system rather than a “closest-source” model. It uses NTP’s standard filtering, selection, and clustering logic (Marzullo-style interval intersection) to determine which servers are trustworthy.
When a server is marked as a falseticker (`x`), the NTP process has compared it with the other configured sources and determined that it is an outlier that does not agree with the surviving candidate set. This commonly occurs when one source is in a remote data center, where WAN jitter and variable delay make that source appear inconsistent relative to local sources.
If all configured servers show `x`, it means the sources disagree too much (or have excessive variability/dispersion), so ISE cannot form a valid consensus and will free-run on its local clock until synchronization is restored.
Reference: [https://www.cisco.com/c/en/us/support/docs/ip/network-time-protocol-ntp/108076-ntp-troubleshoot.html](https://www.cisco.com/c/en/us/support/docs/ip/network-time-protocol-ntp/108076-ntp-troubleshoot.html)