NTP on ASA

[saquib.tandel]

Hello

Is it best practise to configure ASA  as NTP Server for clients on the Inside Network or just allow NTP traffic for host in the inside network.

Thanks

[Jennifer Halim · Accepted solution]

ASA can only be configured as NTP client, not NTP server, hence you have to use other devices as NTP server. I would suggest that you use your internal
router if you have one as an NTP server, and all networking devices, like ASA, router, etc. as NTP client getting the time from internet NTP server.

So all networking devices pointing to an external NTP server, and all clients point to your internal router NTP server.

Hope that helps.

[Kureli Sankar]

I believe the ASA can only be configured as an NTP client. It is a good idea to configure the ASA to sync up time with an NTP server as well.

I suggest to use an inside router as an NTP server for your inside clients and have this router go to through the ASA to an external time source (like a military time source) for NTP.

If you do not use a routers on the inside you can pick a server on the inside.

http://tycho.usno.navy.mil/ntp.html

-KS

[sean_evershed]

If you are not based in the US and you are looking for NTP servers that are closer to home then you can sync your router to one of the server in the pool listed below:

http://www.pool.ntp.org/zone/@

Regards

Sean

[saquib.tandel]

Thanks to all for replying.

I am in the process of configuring an internal Router as NTP Server. On ASA I would only open ports (udp 123) from inside to outside, is this Ok.

ACL is applied on inside interface of ASA.

thanks

ST

[Jennifer Halim]

Yes, UDP/123 is the correct port for NTP.