topic Re: NTP Rule is bidirectional ? in Network Security

NTP Rule is bidirectional ?

MrBeginner — Tue, 22 Nov 2022 15:38:29 GMT

Hi,

I confuse how to work NTP traffic. My network device need NTP from window server. the firewall is between my network device and Window server .I enable NTP server service on window.

So i would like to know If i open NTP port 123 on firewall for the traffic from my network device to window server ?

Re: NTP Rule is bidirectional ?

Rob Ingram — Tue, 22 Nov 2022 15:43:20 GMT

@MrBeginner you'd create a rule from source of the network device to the destination of the ntp server on udp/123. As the firewall is stateful the return traffic should be permitted.

Re: NTP Rule is bidirectional ?

Karsten Iwen — Tue, 22 Nov 2022 15:44:02 GMT

In most situations (which includes yours) the network device is the NTP-client and queries the NTP-server. So, yes, you open the port UDP/123 from device to the server.

Re: NTP Rule is bidirectional ?

MrBeginner — Wed, 23 Nov 2022 07:13:11 GMT

Hi All,

Thanks. Let me know if i am using window as ntp server,cisco network can get time sync ? it is any limitation ? Because I worry network device didn't understand SNTP or window only SNTP protocol.

if i want to do my router device get ntp for NTP server and other network devices will get ntp from my router, what kind of additional configuration do i need to configure on my router ?

what kind of security configuration can do on my router ? any advantage will have if i use ntp soure as loopback ?

Re: NTP Rule is bidirectional ?

Karsten Iwen — Wed, 23 Nov 2022 09:12:43 GMT

It depends on the Cisco device if they do NTP or SNTP. And also if they only implement an NTP client or an NTP server.

Assuming that your Windows Server has a correct time, I would point all network devices to this server. The typical command is

ntp server IPADDRESS

Re: NTP Rule is bidirectional ?

MrBeginner — Sat, 26 Nov 2022 02:22:38 GMT

Hi @Karsten Iwen ,

I only want the to allow on router to access to NTP server and the rest network device want to get NTP from router. It is possible ?

what kind of configuration do i need on my router ? Peer command ?

Re: NTP Rule is bidirectional ?

Ambuj M — Sat, 26 Nov 2022 03:07:58 GMT

should be fairly straight forward, by default router works in NTP client as well as server mode, it means it can get NTP info from external source as client, as well be a NTP server for other devices.

so on upstream router just configure the router with ntp server with command

ntp server <IP of NTP server>

if the server supports authentication then configure authentication as well.

on downstream devices, just point to upstream router as NTP server (same command)

show ntp association to verify, play close attention to reference clock, you will see the reference clock on downstream devices/routers will be upstream router IP and for upstream router, it will be the NTP server you configured.

example upstream

downstream

Re: NTP Rule is bidirectional ?

Karsten Iwen — Sat, 26 Nov 2022 07:41:12 GMT

As already explained, it will work straight out of the box as a server if the router already got the time via NTP. The peer functionality is a different way to synchronise the time between different devices. Make also sure that the other devices can reach the router on UDP/123 and this is not blocked by any router ACL.

Re: NTP Rule is bidirectional ?

MHM Cisco World — Mon, 28 Nov 2022 21:28:22 GMT

I do lab,
NTP Server-inside-FW-outside-NTP client
for FW to allow NTP traffic to pass through you need access-list in OUT direction in
the access-list is eq ntp.

I do lab and test it and client is sync with server inside.

Re: NTP Rule is bidirectional ?

MrBeginner — Tue, 29 Nov 2022 05:42:31 GMT

Hi @MHM Cisco World ,

do you mean the traffic (port 123) is ntp server to client ? do you mean we don't need to allow client to server traffic ( port 123 ) ?

Re: NTP Rule is bidirectional ?

MHM Cisco World — Tue, 29 Nov 2022 10:59:14 GMT

**
friend there are known port you can use
permit udp any any eq 123
OR
permit udp any any eq ntp

and for may lab there are two case

***
NTP Server-inside-FW-outside-NTP client <<- this my lab and since traffic from low to high security level we need ACL

or

NTP client-inside -FW-outside-NTP Server <<- here you dont need any thing, since traffic from high to low security level