topic Re: NTP on ASA in Network Security

NTP on ASA

saquib.tandel — Mon, 11 Mar 2019 19:29:02 GMT

Hello

Is it best practise to configure ASA as NTP Server for clients on the Inside Network or just allow NTP traffic for host in the inside network.

Thanks

Re: NTP on ASA

Jennifer Halim — Thu, 30 Dec 2010 22:29:30 GMT

ASA can only be configured as NTP client, not NTP server, hence you have to use other devices as NTP server. I would suggest that you use your internal
router if you have one as an NTP server, and all networking devices, like ASA, router, etc. as NTP client getting the time from internet NTP server.

So all networking devices pointing to an external NTP server, and all clients point to your internal router NTP server.

Hope that helps.

Re: NTP on ASA

Kureli Sankar — Thu, 30 Dec 2010 22:45:20 GMT

I believe the ASA can only be configured as an NTP client. It is a good idea to configure the ASA to sync up time with an NTP server as well.

I suggest to use an inside router as an NTP server for your inside clients and have this router go to through the ASA to an external time source (like a military time source) for NTP.

If you do not use a routers on the inside you can pick a server on the inside.

http://tycho.usno.navy.mil/ntp.html

-KS

Re: NTP on ASA

sean_evershed — Fri, 31 Dec 2010 00:39:58 GMT

If you are not based in the US and you are looking for NTP servers that are closer to home then you can sync your router to one of the server in the pool listed below:

http://www.pool.ntp.org/zone/@

Regards

Sean

Re: NTP on ASA

saquib.tandel — Fri, 31 Dec 2010 12:37:31 GMT

Thanks to all for replying.

I am in the process of configuring an internal Router as NTP Server. On ASA I would only open ports (udp 123) from inside to outside, is this Ok.

ACL is applied on inside interface of ASA.

thanks

Re: NTP on ASA

Jennifer Halim — Fri, 31 Dec 2010 13:21:26 GMT

Yes, UDP/123 is the correct port for NTP.