NTP Config

[wrwiii122]

I have 30 3550's and no internal time server. I have tried to look at ways to make my server 2003 act as a NTP server with no luck. I was wondering if anyone had any suggestions on how to setup NTP to these switches. I was told that I needed to open the firewall port 123 inbound and point it to the client. So how would I make one a server and the rest clients?

[Richard Burts]

William

The role of NTP server and NTP client are not mutually exclusive. A device may act both as an NTP client learning time from an authoritative source (like an Internet based time source) and then when the device has learned authoritative time that device may then act as an NTP server and send time to other devices.

So in your situation you would configure the switch which will learn time from the Internet with:

ntp server

and then you would configure the other switches with:

ntp server

You might consider having more than one switch learn time from the Internet for redundancy

HTH

Rick

[wrwiii122]

Thanks Rick that was helpful. I have three more questions.

1. When I use the web interface (I use both everytime I do something to become familiar with both) it has settings for key id and key value. What are these and are they needed for talking to a free internet server?

2. I would love to have two devices requesting time from an internet time server but I read somewhere that I will have to open port 123 incoming and forward it to the client. Is this true because I would only be able to do one then.

3. Is there anything special I need to do to make one of my devices requesting the time from the internet server a server itself for the rest of the clients?

[Richard Burts]

William

1) NTP has an option to authenticate requests and responses between devices. You might use that option for NTP communication within your own network. The public NTP servers do not need this.

2) You will certainly need to allow port 123 (using the same port as source port and destination port) to go out through the firewall and to return through the firewall. Whether you need to forward it to a specific client is dependent on your local environment. Most of the customers I have dealt with just allow 123 through (or allow 123 to a couple of inside addresses if they really want to lock things down) but do not specifically forward the traffic.

3) There is not anything special you need to do. In the NTP protocol once a device has learned time from an authoritative source that device is able to offer time to other devices. So all you need to do is to configure a device (or several devices) to learn time from a server in the Internet and then configure other devices to use your first device as their NTP server. Note that routers and switches can be configured with more than one NTP server. If configured with more than one server the device will query all the servers configured, compare their responses, and choose one as the one it will base its time on. This provides for effective redundancy.

HTH

Rick

[wrwiii122]

I thought you could only allow incoming ports to specific clients and not just allow a open port incoming. How does the firewall know where to send the application/port request to? Also do you know what the command on a PIX is to allow a open incoming port?

[Richard Burts]

On the PIX you open a port by adding a permit statement to the inbound access list on the outside interface. There are choices to be made in configuring the access list: the source address could be a specific remote host, could be a remote network, could be any and the destination address could be a specific host, a subnet or network, or any. examples of various source would look like:

access-list acl_outside permit udp host 192.168.1.1 host 10.1.1.1 eq ntp

access-list acl_outside permit udp 192.168.0.0 255.255.0.0 host 10.1.1.1 eq ntp

access-list acl_outside permit udp any host 10.1.1.1 eq ntp

examples of various destination would look like:

access-list acl_outside permit udp 192.168.0.0 255.255.0.0 host 10.1.1.1 eq ntp

access-list acl_outside permit udp 192.168.0.0 255.255.0.0 10.1.1.0 255.255.255.0 eq ntp

access-list acl_outside permit udp 192.168.0.0 255.255.0.0 any eq ntp

HTH

Rick

[wrwiii122]

I setup one of my switches to point to another switch but it states that clock is unsyncronized. I read somewhere that you must enter the NTP MASTER command when using a router. 3550's dont have this command so can they act as a ntp server?

[Richard Burts]

William

In general a router or switch can act as an NTP server if it has authoritative time. It can get authoritative time either by learning time from an authoritative source or by using the command NTP master.

So it is not quite true that to act as an NTP server it must be configured with NTP master. I have lots of routers and switches which act as NTP servers but are not configured with NTP master.

I do not have enough experience with the 3550 to know if it can act as a server without an external source of authoritative time.

HTH

Rick

[Wilson Samuel]

Hi,

The easiest and best way to setup a centralized time server for your entire enterprise is to:-

1. Make sure that your Internet Firewall becomes an NTP Server for the internal clients and takes in turn time from Internet (there are many Government Time Server e.g. ntp.nasa.gov. however make sure you take permission from them to use before you actually point your FW / Router to them.)

2. Make sure your ADS DC gets the time from the Firewall, with this all the machines and servers (with ADS) would automatically get the correct time from Internet

3. Point all your switches / routers and all other devices to learn time from the windows DC and ADCs.

This would make sure that in case of firewall replacement you needn't work very hard.

If you require config commands for Windows and Routers / Switches / Firewall please paste a qurey and I shall be more than glad to help you out.

Regards,

Wilson Samuel

3.

[dseliverstov]

Hi

I think this document will to help you.

http://www.cisco.com/en/US/tech/tk869/tk769/technologies_white_paper09186a0080117070.shtml

Dmitry.