FirePOWER time out of sync with FireSIGHT

[Cory Brown]

All,

Several of my FirePOWER sensors (7020 and 7030's running 5.3.0.8) are alerting for time sync.  The FireSIGHT is syncing fine with the assigned NTP server, but the FirePOWER sensors do not sync.  I have gone through this document Troubleshoot Issues with Network Time Protocol (NTP) on FireSIGHT Systems and everything seems fine.  Could something be wrong with the Management Virtual Network passing the time sync? 

>Show ntp on the FirePOWER reads:

NTP server :127.0.0.2 (Cannot Resolve)

Status         : Unknown

Offset          : -8.800

Last Update: 12d (Seconds)

$ ntpq -pn

remote         refid    st t when  poll  reach  delay  offset   jitter

127.0.0.2    .INIT.   16 u    -      512    0      0.000  0.000  0.000

Thanks

[Jetsy Mathew]

Hello Cory,

Ideally you should sync the Firesight Management Center from either the Sourcefire global NTP or your local NTP server. Then the Firepower should be synced with Firesight.Here in the output it looks like the NTP server is not ye configured. Verify the connectivity (use ping commands and confirm the network connectivity ) between the NTP and Firesight. If you configured the NTP details in the Firesight , you should be able to see the same after the system policy reapply.

Rate and correct if the post helps you.

Regards

Jetsy 

[Cory Brown]

Thanks for the reply, Jetsy.  Our configuration is as you described.  Time-sync on FireSIGHT is fine.  FirePOWERs are not syncing despite being configured to do so on the FireSIGHT.

[Jetsy Mathew]

Hello Cory,

Could you please perform the following in the Firepower CLI.Login via ssh and elevate to root user and perform the following .

ntpdate -u <ip address of the Firesight device>

Then restart the ntp service.

pmtool restartbyid ntpd

Give it another 5-10 minutes so that the health poll gets finishes.

Let me know if this works or not.

Rate if the post helps you

Regards

Jetsy