PIX NTP SERVER SETUP - HOW?

[pdpmail]

I want to set up a NTP server on my PIX. I have a Pix 501 with 2 interfaces. The outside i/f connects to a Windows XP machine which has a broadband connection to the Internet. The XP machine itself gets accurate clock signal from a remote atomic clock time source.

What software can I use to set up an NTP time server with this set up?

Thanks

[bvanniekerk]

You can either specify the same atomic clock or if you have a clock source running on the inside(one that is accurate). If you do decide to go outside, you should thing of specifying a key so that you are sure you only sync off the specified clock, instead of syncing off a clock source that spoofed the atomic clock IP.

Hope you get sorted.

[pdpmail]

Thanks for that. Do I need specific NTP server software - or would the Pix just collect time off the PC (or the Internet time source machine) ?

I assume I need some 'server' software element?

[bvanniekerk]

If you intend on getting the time from the upstream server, you'll either need to install software on in or enable ntp server on it. Not very familiar with windows & ntp. Why not specify an outside source with a trusted-key.

[Terry Pattinson]

The pix can be an NTP client to either an external (Public server) or internal server. To create an internal server:

The NTP server software is open-source and can be downloaded from

http://norloff.org/ntp/

The best way to implement NTP is to use an atomic clock (not very practical at about US$100K) or to use a GPS based clock (trimble is the GPS clock I know of) http://www.trimble.com/gps/timing1.html. Using an atomic clock or GPS time feed, plus NTP server software creates a stratum 1 clock (the lower the stratum, the closer to a real time source).

However, most of us cannot afford the extra expense. As a result, we use internet feeds, such as those available at

http://www.eecis.udel.edu/~mills/ntp/servers.html

Read the rules of engagements. Something new and interesting is ntp server pooling http://www.pool.ntp.org/ (using DNS round robin to select NTP servers)

Using Public NTP servers means we rely on public NTP stratum 1 or 2 servers and our internal server would be a stratum 2 or 3 server. I've not seen md5 checksumming available on public servers (which would be very strange anyway, as md5 is a shared secret type of environment and not a public keying environment and could be faked really easily), so I've generally synced up to between 5-10 ntp servers to an internal server and then sync my network equipment to the internal server. NTP is resistant to change once it syncs, so it has limited anti-spoofing built right in, so I've never worried about that side of things. NTP is a very lite app so I've also never worried about CPU, memory or bandwidth utilization in the standard network environments. Of course, hanging a few thousand ntp clients off of the server may change the landscape.

HTH

Terry