topic Re: PIX NTP SERVER SETUP - HOW? in Network Security

PIX NTP SERVER SETUP - HOW?

pdpmail — Fri, 21 Feb 2020 07:33:04 GMT

I want to set up a NTP server on my PIX. I have a Pix 501 with 2 interfaces. The outside i/f connects to a Windows XP machine which has a broadband connection to the Internet. The XP machine itself gets accurate clock signal from a remote atomic clock time source.

What software can I use to set up an NTP time server with this set up?

Thanks

Re: PIX NTP SERVER SETUP - HOW?

bvanniekerk — Fri, 06 Aug 2004 11:09:08 GMT

You can either specify the same atomic clock or if you have a clock source running on the inside(one that is accurate). If you do decide to go outside, you should thing of specifying a key so that you are sure you only sync off the specified clock, instead of syncing off a clock source that spoofed the atomic clock IP.

Hope you get sorted.

Re: PIX NTP SERVER SETUP - HOW?

pdpmail — Fri, 06 Aug 2004 11:17:45 GMT

Thanks for that. Do I need specific NTP server software - or would the Pix just collect time off the PC (or the Internet time source machine) ?

I assume I need some 'server' software element?

Re: PIX NTP SERVER SETUP - HOW?

bvanniekerk — Fri, 06 Aug 2004 11:23:47 GMT

If you intend on getting the time from the upstream server, you'll either need to install software on in or enable ntp server on it. Not very familiar with windows & ntp. Why not specify an outside source with a trusted-key.

Re: PIX NTP SERVER SETUP - HOW?

Terry Pattinson — Fri, 06 Aug 2004 14:43:40 GMT

The pix can be an NTP client to either an external (Public server) or internal server. To create an internal server:

The NTP server software is open-source and can be downloaded from

http://norloff.org/ntp/

The best way to implement NTP is to use an atomic clock (not very practical at about US$100K) or to use a GPS based clock (trimble is the GPS clock I know of) http://www.trimble.com/gps/timing1.html. Using an atomic clock or GPS time feed, plus NTP server software creates a stratum 1 clock (the lower the stratum, the closer to a real time source).

However, most of us cannot afford the extra expense. As a result, we use internet feeds, such as those available at

http://www.eecis.udel.edu/~mills/ntp/servers.html

Read the rules of engagements. Something new and interesting is ntp server pooling http://www.pool.ntp.org/ (using DNS round robin to select NTP servers)

Using Public NTP servers means we rely on public NTP stratum 1 or 2 servers and our internal server would be a stratum 2 or 3 server. I've not seen md5 checksumming available on public servers (which would be very strange anyway, as md5 is a shared secret type of environment and not a public keying environment and could be faked really easily), so I've generally synced up to between 5-10 ntp servers to an internal server and then sync my network equipment to the internal server. NTP is resistant to change once it syncs, so it has limited anti-spoofing built right in, so I've never worried about that side of things. NTP is a very lite app so I've also never worried about CPU, memory or bandwidth utilization in the standard network environments. Of course, hanging a few thousand ntp clients off of the server may change the landscape.

HTH

Terry