topic NTP in Network Security

NTP

kunal-united — Mon, 11 Mar 2019 21:45:49 GMT

Hi,

Cisco Pix is able to synchronize with the NTP server.

What could be the issue?

NTP is connected on the inside zone.

configuration

ntp server 10.10.194.165 source inside-zone prefer.

pix can ping the IP and is reachable.

Please advise.

NTP

kunal-united — Thu, 03 Nov 2011 19:15:11 GMT

Hi,

could this be an issue.

firewall(config)# show ntp status

Clock is unsynchronized, stratum 16, no reference clock

nominal freq is 99.9984 Hz, actual freq is 99.9984 Hz, precision is 2**6

reference time is 00000000.00000000 (01:28:16.000 EST Thu Feb 7 2036)

clock offset is 0.0000 msec, root delay is 0.00 msec

root dispersion is 0.00 msec, peer dispersion is 0.00 msec

what does it mean

NTP

caseth0102 — Thu, 03 Nov 2011 19:42:34 GMT

Hi Kunal-

What version of code are you running?

Re: NTP

jaysoo — Fri, 04 Nov 2011 00:11:35 GMT

It could be something to do with what kind of NTP server you are running. I've had no luck with Cisco devices getting time from Microsoft NTP servers. I ended up using Meinberg NTP which is free and pretty simple to install and configure. Works well too.

NTP

Richard Burts — Fri, 04 Nov 2011 03:08:41 GMT

I agree that more information might be helpful.

What kind of device is 10.10.194.165?

Can you post the output of show ntp assoc?

HTH

Rick

Re: NTP

kunal-united — Fri, 04 Nov 2011 14:13:48 GMT

Hi,

Cisco PIX Firewall Version 6.3(4).

firewall(config)# show ntp association

address ref clock st when poll reach delay offset disp

~10.10.194.165 10.10.97.4 16 737d 64 0 1.0 44030. 16000.

* master (synced), # master (unsynced), + selected, - candidate, ~ configured

firewall(config)# show ntp association detail

10.10.194.165 configured, insane, invalid, stratum 16

ref ID 10.10.97.4, time ce921496.e041248d (19:53:42.875 EST Tue Oct 27 2009)

our mode client, peer mode server, our poll intvl 64, peer poll intvl 1024

root delay 113.33 msec, root disp 69.96, reach 0, sync dist 222.290

delay 1.02 msec, offset 44030.2505 msec, dispersion 16000.00

precision 2**18, version 3

org time 00000000.00000000 (01:28:16.000 EST Thu Feb 7 2036)

rcv time 00000000.00000000 (01:28:16.000 EST Thu Feb 7 2036)

xmt time d25e6cb2.ff3852f9 (08:52:50.996 EST Fri Nov 4 2011)

filtdelay = 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00

filtoffset = 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00

filterror = 16000.0 16000.0 16000.0 16000.0 16000.0 16000.0 16000.0 16000.0

firewall(config)# show ntp status

Clock is unsynchronized, stratum 16, no reference clock

nominal freq is 99.9984 Hz, actual freq is 99.9984 Hz, precision is 2**6

reference time is 00000000.00000000 (01:28:16.000 EST Thu Feb 7 2036)

clock offset is 0.0000 msec, root delay is 0.00 msec

root dispersion is 0.00 msec, peer dispersion is 0.00 msec

cfwprd1a(config)#

Thanks

NTP

cadet alain — Fri, 04 Nov 2011 14:19:29 GMT

Hi,

verify the clock on the firewall is not too far from the clock on the NTP server otherwise it will take ages to synchronize.

configure the clock as close as posible to real time( UTC) then wait a few secs or mins max for the synchronization to take place.

Alain.

NTP

caseth0102 — Fri, 04 Nov 2011 14:46:29 GMT

Try using a router or some other device close in proximity, to rule out your current device as the suspect. I would do this first instead of spending anymore time troubleshooting the current scenario.

NTP

kunal-united — Fri, 04 Nov 2011 16:00:32 GMT

firewall# ping 10.10.194.165

10.10.194.165 response received -- 0ms

So it is not far

NTP

kunal-united — Fri, 04 Nov 2011 16:03:15 GMT

I have another firewall configured the same way in the same inside zone for NTP.

But that also is not syncronized.

NTP

cadet alain — Fri, 04 Nov 2011 16:37:36 GMT

Hi,

Did you try setting the clock as close as possible to real-time as proposed?

If it still fails can you capture packets on the ntp server to see if it gets the packets from inside interface of ASA?

You can also do a capture on ASA for this traffic

Alain.

NTP

kunal-united — Fri, 04 Nov 2011 18:35:38 GMT

setting the clock would be like manual. How would NTP work?

NTP

cadet alain — Fri, 04 Nov 2011 20:09:04 GMT

Hi,

you first set the clock manually as close as possible as real time then your NTP syncing will be done and your clock will always be accurate .I f you want to sync a clock with NTP which has a time really far from ntp server then it will take ages to sync.

Alain.

NTP

kunal-united — Fri, 04 Nov 2011 20:48:55 GMT

Hi,

I changed the NTP server to 10.10.194.226 and the clocks have synchronized.

But when I revert to 10.10.194.165 it becomes unsynchronized.

So what does this mean?

Does it mean that 10.10.194.165 is having the wrong clock or 10.10.194.165 is taking clock from 10.10.97.4

firewall(config)# show ntp association

address ref clock st when poll reach delay offset disp

~10.10.194.165 10.10.97.4 16 737d 64 0 1.0 44030. 16000.

* master (synced), # master (unsynced), + selected, - candidate, ~ configured

NTP

cadet alain — Fri, 04 Nov 2011 21:06:24 GMT

Hi,

what are these 2 adresses you are syncing to?

Alain

NTP

Richard Burts — Sat, 05 Nov 2011 08:33:49 GMT

If NTP sync is successful to 10.10.194.226 but not successful to 10.10.194.165 it either indicates that there is a problem in communication for NTP to 10.10.194.165 or it means that there is some issue with NTP on that device.

In an earlier post in this thread you posted this output

firewall(config)# show ntp association

address ref clock st when poll reach delay offset disp

~10.10.194.165 10.10.97.4 16 737d 64 0 1.0 44030. 16000.

I believe that if the ref clock is non-zero that you are communicating NTP with the device. So there must be something about NTP on that device. We have asked before, and I will ask again - what kind of device is 10.10.194.165?

HTH

Rick