topic Re: How to change NTP server and DNS on FTD ? in Network Security

How to change NTP server and DNS on FTD ?

sam cook — Fri, 21 Feb 2020 15:31:05 GMT

Hi,

I have an issue with changing NTP and DNS values on my HA of FTD2110.

The 2 FTDs are connected to my FMC.

I could not find how to change the NTP servers or the DNS servers

> show ntp
NTP Server : 127.127.1.1
Status : Unknown
Offset : 0.000 (milliseconds)
Last Update : 44h (seconds)

NTP Server : 127.0.0.2
Status : Being Used
Offset : 0.238 (milliseconds)
Last Update : 32 (seconds)

> show dns
INFO: no activated FQDN
>

HELP please

Re: How to change NTP server and DNS on FTD ?

yogdhanu — Thu, 15 Mar 2018 19:53:47 GMT

Hi Sam,

You need to change the info from platform settings option under Device section of FMC.

Create a new policy and make changes and assign the FTD in that. Deploy the changes to take affect.

You may change the DNS settings in FTD from CLI as well.

In the FTD CLISH mode type "configure network dns servers 4.2.2.2" (example)

Then nslookup and use a hostname to verify.

Rate if helps,

Yogesh

Re: How to change NTP server and DNS on FTD ?

sam cook — Fri, 16 Mar 2018 11:03:28 GMT

Tnak you for your help !

I added the NTP server (194.2.0.28) but i still see the 127.127.1.1 and my timezone is still wrong.

Re: How to change NTP server and DNS on FTD ?

Marvin Rhoads — Sun, 18 Mar 2018 11:12:33 GMT

Try restarting the daemons after making the changes.

Switch to expert mode and use the following commands for DNS and NTP respectively:

sudo /etc/rc.d/init.d/nscd restart

sudo /ngfw/usr/bin/ntpd restart

Re: How to change NTP server and DNS on FTD ?

sam cook — Mon, 19 Mar 2018 13:10:56 GMT

Hi,

Thank you but still the same 😞

Re: How to change NTP server and DNS on FTD ?

Marvin Rhoads — Mon, 19 Mar 2018 13:16:50 GMT

Your sensor's ntp is falling back to using localhost (e.g. its own internal clock).

Can your sensor reach the configured NTP server on udp/123?

Re: How to change NTP server and DNS on FTD ?

sam cook — Mon, 19 Mar 2018 13:57:54 GMT

I can ping it, how can I test port 123 UDP ?

Re: How to change NTP server and DNS on FTD ?

Marvin Rhoads — Mon, 19 Mar 2018 15:30:03 GMT

You can use ntpq from expert mode and look at the peers to see if the configured server is reachable and providing the ntp service.

> show ntp
NTP Server                : 103.16.182.23  (time.unisza.edu.my)
Status                    : Available
Offset                    : -11.995 (milliseconds)
Last Update               : 467 (seconds)

NTP Server                : Managing DC
Status                    : Available
Offset                    : 22.754 (milliseconds)
Last Update               : 61 (seconds)

NTP Server                : Managing DC
Status                    : Being Used
Offset                    : 0.479 (milliseconds)
Last Update               : 578 (seconds)

> expert
admin@vftd-new:~$ ntpq
ntpq> peers
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
*127.0.0.2       103.16.182.23    3 u  595 1024  377    5.930    0.479   4.219
+time.unisza.edu 87.120.164.97    2 u  484 1024  367   48.632  -11.995   4.327
+202.45.138.123  202.21.137.10    2 u   78 1024  347   26.536   22.754   4.649
ntpq>

Re: How to change NTP server and DNS on FTD ?

sam cook — Mon, 19 Mar 2018 15:36:12 GMT

I can see my NTP server ntp0.oleane.net , but what to do to make it primary :

Re: How to change NTP server and DNS on FTD ?

Marvin Rhoads — Mon, 19 Mar 2018 15:41:17 GMT

It being in ".INIT." status means that it is configured but not reachable (or not serving up ntp).

Once it successfully initializes it should report a stratum better than the Stratum 10 that your localhost provides. (Stratum 16 is the default for unknown or no NTP.)

Re: How to change NTP server and DNS on FTD ?

sam cook — Mon, 19 Mar 2018 15:50:19 GMT

Okay, thanks for the explanation.

Should I add an access policy to allow flow on port UDP 123 ?

or maybe is it because I'm using management interface to reach the NTP server ?

Maybe FTD is designed to use only outisde or indide interface for NTP ?

Re: How to change NTP server and DNS on FTD ?

Marvin Rhoads — Mon, 19 Mar 2018 16:18:50 GMT

The ntp queries from your FTD device should originate from the management interface. That source address must have the udp/123 access to the configured and working ntp server.

Re: How to change NTP server and DNS on FTD ?

damode — Thu, 07 Mar 2019 01:02:02 GMT

Hi, where exactly are the setting for dns within the Platform settings for FMC ? I am dont see see any such settings there.

Re: How to change NTP server and DNS on FTD ?

Marvin Rhoads — Thu, 07 Mar 2019 01:48:39 GMT

Platform settings are for managed sensors. For those, there's a DNS tab:

For FMC's DNS resolver please look under System > Configuration > Management Interfaces > Shared Settings:

Re: How to change NTP server and DNS on FTD ?

johbens — Mon, 22 Jul 2019 17:08:05 GMT

Which version do you have? The FMC that I have doesnt have DNS options:

Re: How to change NTP server and DNS on FTD ?

Marvin Rhoads — Tue, 23 Jul 2019 03:00:42 GMT

The screenshot I posted earlier was taken from a FMC 6.3 system. (since then it's been upgraded to 6.4).

I couldn't find mention in the release notes but I checked a 6.2.3.14 system and it's not there.

Re: How to change NTP server and DNS on FTD ?

G3000LEE — Wed, 02 Nov 2022 20:08:20 GMT

Can you please help me as I need to change the NTP server on the FTDv.
I have changed the NTP server on the FMC via the GUI but there is no option to edit the FTD, and now I have an out of sync issue.

Re: How to change NTP server and DNS on FTD ?

Marvin Rhoads — Thu, 03 Nov 2022 15:53:59 GMT

@G3000LEE did you do as suggested in one of the earlier responses here? i.e.:

You need to change the info from platform settings option under Device section of FMC.

Create a new policy and make changes and assign the FTD in that. Deploy the changes to take affect.

Re: How to change NTP server and DNS on FTD ?

G3000LEE — Thu, 03 Nov 2022 16:11:12 GMT

Sorry, I am very new to FMC/FTD. I am teaching myself this technology using VM's and only started this week.

I found where to change the NTP setting for the FMC on the FMC. But I then run into issues with the FTDs being out of sync with the FMC. I want to change the FMC and all the FTDs to use my home lab NTP server which is my Cisco switch so all Lab and home hardware are using the same server

I am not advanced enough and don't know what you mean by "Create a new policy and make changes and assign the FTD in that.".

Are you saying I can create a ACP, which will change the FTDs NTP server settings?

Re: How to change NTP server and DNS on FTD ?

Marvin Rhoads — Thu, 03 Nov 2022 16:27:33 GMT

In FMC, go to Devices, Platform Settings. Create a Platform policy and target your FTD device(s). In that policy, edit the Time Synchronization setting. Save and deploy.