topic Remove FMC NTP 127.127.1.1 in Network Security

Remove FMC NTP 127.127.1.1

johnlloyd_13 — Fri, 21 Feb 2020 16:46:12 GMT

hi,

i've added google NTP in FMCv but i can still see 127.127.1.1. see photo attached.

is there any way to remove it or is this a system default?

Re: Remove FMC NTP 127.127.1.1

Alessandro Roberto Alves — Tue, 05 Feb 2019 19:26:14 GMT

In Time Synchronization, how did you leave it configured? Serve Time via NTP (Enable / Disable)? Set My Clock (Manually ... or Via NTP from). This information changes in Time.

Re: Remove FMC NTP 127.127.1.1

johnlloyd_13 — Wed, 06 Feb 2019 00:16:07 GMT

hi,

i've set 'Enabled' for 'Serve Time via NTP' and chose 'Via NTP from' for 'Set My Clock' and typed 'time.google.com'

see attached photo.

i can also ping FQDN from FMC terminal:

admin@FMCv:~$ sudo ping time.google.com
Last login: Tue Feb 5 09:43:46 UTC 2019
PING time.google.com (216.239.35.8) 56(84) bytes of data.
64 bytes from time3.google.com (216.239.35.8): icmp_req=1 ttl=41 time=241 ms
64 bytes from time3.google.com (216.239.35.8): icmp_req=2 ttl=41 time=236 ms
64 bytes from time3.google.com (216.239.35.8): icmp_req=3 ttl=41 time=235 ms
^C
--- time.google.com ping statistics ---
4 packets transmitted, 3 received, 25% packet loss, time 3003ms
rtt min/avg/max/mdev = 235.460/237.887/241.468/2.584 ms

Re: Remove FMC NTP 127.127.1.1

Alessandro Roberto Alves — Wed, 06 Feb 2019 01:13:45 GMT

Hi, The 127.127.1.1 address you see in the simply says that the router is using its own internal clock as the time source. Do not worry about it, it is the correct behavior.

Re: Remove FMC NTP 127.127.1.1

Marvin Rhoads — Wed, 06 Feb 2019 03:38:35 GMT

Your screenshot show you have synced with the external ntp server.

FMC retains 127.127.1.1 (local clock from the underlying Linux OS based on hardware the system is running on) as a potential backup in the event that the defined time server in unreachable. This is normal and expected behavior.

More details on FMC and NTP here:

https://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118626-technote-firesight-00.html