topic Re: ASA5520 CLOCK diviate from Microsoft AD server in Network Security

ASA5520 CLOCK diviate from Microsoft AD server

arumugasamy — Mon, 11 Mar 2019 12:25:43 GMT

Dear all,

I setup the remote accesss vpn using active directory ldap, kerbi for authen and authro. It is works well but i am facing frequebt tunnel disconnections.Syslog shows that the clock setting bet AD server and ASA 10 minites different. After set the ASA time back to the AD time tunnel comes up. It is now frequent and i do not want the manual setting everytime.

Please help me how can i setup the time in sync.

Thanks

swami

Re: ASA5520 CLOCK diviate from Microsoft AD server

rahmant — Wed, 02 Apr 2008 10:23:37 GMT

How are both the 5520 and the AD server syncing time now? Are either/both configured for NTP?

Tariq

Re: ASA5520 CLOCK diviate from Microsoft AD server

cisco24x7 — Wed, 02 Apr 2008 12:39:09 GMT

I am not familiar with ms Active Directory but

if I am not mistaken, microsoft uses SNTP

(simple NTP) instead of the regular NTP like

Unix/Linux. I use Linux server to sync NTP

between the Pix and the Linux and it works

fine.

Using Microsoft may be is the source of the

problem.

CCIE Security

Re: ASA5520 CLOCK diviate from Microsoft AD server

arumugasamy — Wed, 02 Apr 2008 15:34:04 GMT

Tariq,

No ntp right now.

swami

Re: ASA5520 CLOCK diviate from Microsoft AD server

rahmant — Wed, 02 Apr 2008 18:41:19 GMT

As cisco24x7 mentioned, you can set ntp on your ASA to automagically update time. Read up in the config guide for this - in 8.0, the section is under "getting started..." / "configuring basic settings" / "setting the date and time" / "setting the date and time using an ntp server"

From my understanding, AD servers typically already sync time amongst themselves - you should confirm that with your AD admin(s). If they're not using NTP to get updated time from the Internet or radio source, try to figure out why 🙂

If there's no reason not to, have your AD environment and your ASA sync NTP from a few good sources. You can find some public sources from here: http://www.ntp.org

Re: ASA5520 CLOCK diviate from Microsoft AD server

arumugasamy — Thu, 03 Apr 2008 08:57:09 GMT

Thanks lot. Let me talk to the AD admin.

swami