topic Re: configuration clock module IPS in Network Security

configuration clock module IPS

alfredoelias — Sun, 10 Mar 2019 12:01:28 GMT

I am setting my IPS module but I have trouble putting on the hour. I'm doing it via NTP but when I go to events I get the hour badly adds six coreg hour. I can do to this.

Re: configuration clock module IPS

Scott Fringer — Wed, 09 Jun 2010 16:47:53 GMT

Have you also configured the timezone offset and timezone on the sensor?

conf t

service host

time-zone-settings

offset

Scott

Re: configuration clock module IPS

alfredoelias — Thu, 10 Jun 2010 15:45:54 GMT

time-zone-settings

standard-time-zone-name CST

offset 0

exit

ntp-server 201.247.152.233

sh clock

21:15:22 CST Tue Jun 08 2010

This is the configuration and the problem persists

Re: configuration clock module IPS

Scott Fringer — Thu, 10 Jun 2010 16:06:06 GMT

That's the problem - your offest from GMT is set to 0. For CST the offset should be -360 with the CDT offset automatically changing to -300 (when you enable summertime in the configuration)

Scott

Re: configuration clock module IPS

alfredoelias — Thu, 10 Jun 2010 16:31:53 GMT

exit

offset -360

standard-time-zone-name CST

exit

ntp-server 201.247.152.233

the problem persist

Re: configuration clock module IPS

Scott Fringer — Thu, 10 Jun 2010 16:51:45 GMT

Could you provide the following output:

sh clock

sh stat host

Scott

Re: configuration clock module IPS

alfredoelias — Thu, 10 Jun 2010 17:34:40 GMT

I send the show clock and show stat host

Re: configuration clock module IPS

Scott Fringer — Thu, 10 Jun 2010 17:43:27 GMT

I see the 'sh stat host' output, which indicates successful NTP server synchronization.

I do not see the current output of 'sh clock'.

From the output, is this an AIP-SSM or an IDSM-2 or a different IPS module?

Scott

Re: configuration clock module IPS

alfredoelias — Thu, 10 Jun 2010 18:45:02 GMT

Hi Scott

thanks for you help this is module IPS in ASA I send the show

ROM-TLC-MIPS-01# sh clock
11:25:31 CST Thu Jun 10 2010

the time is corect but in my view IPS events shows me the 6 hours in advance

Re: configuration clock module IPS

Scott Fringer — Thu, 10 Jun 2010 18:48:13 GMT

OK - so the time is correct on the sensor; that is now confirmed.

Where are you viewing the events that you are seeing the 6 hour time difference? Are you using IEV, IME, CS-MARS, another tool?

Scott

Re: configuration clock module IPS

alfredoelias — Thu, 10 Jun 2010 18:51:48 GMT

I can see events in the IPS monitor I do not use anything else only IPS

Re: configuration clock module IPS

Scott Fringer — Thu, 10 Jun 2010 18:55:54 GMT

The event viewer within IDM should present the event in both the sensor local time and sensor UTC time.

Events displayed on the CLI of the sensor via 'sh even alert' should also provide the event time in both local time and UTC time

Scott