cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1242
Views
0
Helpful
4
Replies

Firewall ASA as Master NTP

Christian Jorge
Level 1
Level 1

Good Morning

We are facing this issue regarding network infrastructure of some customers we take care.

In those infrasctructure, only the network layer 3 is allowed to consult an NTP Master Server (as stratum 0 for example). Although this layer 3 device acts as a NTP client related to that server, for other devices in this infrastructure, the layer 3 becomes the master NTP (stratum > 0).

For some infrastructures a firewall ASA performs the layer 3 role and must to be this way. Other devices depends on the firewall to synchronize the clock.

The question is: how can we configure the ASA as a NTP server or is it not possible?

4 Replies 4

James Leinweber
Level 4
Level 4

I don't think there is any firmware support for using an ASA as an NTP time source, sorry.

How deeply do you care about the stratum?  I run most of my clients at stratum 4, with only my outside DNS/NTP servers at stratum 3, consulting some upstream but nearby (inside the AS) stratum 2 servers.  This works fine; I'm not shooting for nanosecond precision.  There ought to be some NTP servers you can tap into closer than stratum 0 or 1.  Or you could buy a GPS based gizmo to act a a local time source.

-- Jim Leinweber, WI State Lab of Hygiene

Hello James

Actually, we are not worried about stratum value. Of course, the lesser the better.

My concern is only regarding Cisco ASA be consulted regarding NTP by other devices.

Defined be really not possible, I need to investigate another solution

jocamare
Level 4
Level 4

No, the NTP server feature is not supported on ASAs and doesn't look like it's going to be any time soon.

I think you can use static PAT on UDP/123 (NTP) on NTP-client-site interface of an ASA. So clients will direct their NTP request to the ASA and the ASA will forward them to real ntp server somewhere. For NTP-clients ASA is gonna be an NTP-server in their config. Not common, but i think it'll work.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: