Allowing NTP in through PIX

[monkeyboy]

Apologies for my ignorance but is there any way of securing NTP coming in from an external public (ie: not owned by us) clock source into our internal network?

I presume we cannot use ntp authentication because the time source is not ours?

Or are you limited to the stateful nature of the firewall (ie internal host request for UDP port 123 thru the pix & reply) & is this inherently secure enough?

thanks in advance

Mark

[piseli]

How about allowing incomming NTP traffic from a trusted NTP outside Server to a internal NTP Master ?

example:

access-list acl_outside permit udp host Trusted-NTP-Server-Public host MyPublicIP eq 123

access-group acl_outside in interface outside

static (inside,outside) udp MyPublicIP 123 NTP-Master-Private 123 netmask 255.255.255.255 0 0

In this example I use a port forwarding udp 123 to an internal private IP.

sincerly

Patrick

[monkeyboy]

Thanks Patrick - just one more question - what would be the command to put on the internal NTP master say my internal NTP master was a router?

I have tried:

ntp server x.x.x.x (external clock ip)

ntp master

This works but is does not show up as a hit in the pix ntp access-list.

Mark

[piseli]

Should look something like this:

clock timezone EST -05

# set timezone

ntp authentication-key 1 md5 123456789012345678901234567890 7

ntp authenticate

ntp trusted-key 1

# Enables authentication with NTP public Server

ntp server PubIP-NTPServer1 prefer

ntp server PubIP-NTPServer2

# defines IP address of public NTP Servers

ntp master 10

ntp peer Your-Internal-NTP-server-IP-1

ntp peer Your-Internal-NTP-server-IP-2

ntp peer Your-Internal-NTP-server-IP-3

ntp max-associations 3

#Defines Ntp clients

interface serial 0/0

ntp enable

# enbles ntp traffic on outside interface

interface serial 0/1

ntp disable

# disables ntp traffic on this interface

interface ethernet 0/0

ntp enable

# enbles ntp traffic on internal interface

You also should define a access-list restrict NTP access.

Command Reference:

http://www.cisco.com/en/US/products/sw/iosswrel/ps1839/products_command_reference_chapter09186a008017388f.html#wp1049846

sincerely

Patrick

[piseli]

Take a look at this guide:

http://www.secwiz.com/admin/Portal/LinkClick.aspx?tabid=28&table=Links&field=ItemID&id=126&link=http%3a%2f%2fnsa2.www.conxion.com%2fcisco%2fguides%2fcis-2.pdf

http://www.secwiz.com/Default.aspx?tabid=28

sincerely

Patrick