router can't get sync clock from ASA

[Randyx]

Hi Guys,

Hope you are all doing well. I need help with my setup.

Above is my setup. I was trying to get the R1 synch the clock with the NTP server. I pointed to my ASA's interface as my ntp server. The ASA is already sync. It is connected to Cloud1 which connected to the internet via loopback. 

The problem is I R1's clock is not getting sync with the ASA. I already allowed ntp udp port 123 on the ASA.

Below is my config.

ASA:

ciscoasa(config)# sh run | i access-list
access-list INSIDE_IN extended permit udp any any eq ntp
access-list OUTSIDE_IN extended permit udp any any eq ntp

ciscoasa(config)# sh run | i access-group
access-group INSIDE_IN in interface INSIDE
access-group OUTSIDE_IN in interface OUTSIDE

ciscoasa(config)# sh run | i nat
nat (INSIDE,OUTSIDE) source dynamic any interface

ciscoasa(config)# sh ip
System IP Addresses:
Interface Name IP address Subnet mask Method
GigabitEthernet0 INSIDE 10.10.10.1 255.255.255.0 CONFIG
GigabitEthernet1 OUTSIDE 192.168.37.2 255.255.255.0 CONFIG

ciscoasa(config)# sh run | i ntp
ntp server 203.95.213.129

ciscoasa(config)# sh run | b router
router ospf 1
network 10.10.10.0 255.255.255.0 area 0
network 192.168.37.0 255.255.255.0 area 0

default-information originate always

route OUTSIDE 0.0.0.0 0.0.0.0 192.168.37.1 1

R1:

R1#sh ip int bri | ex unassi
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 10.10.10.2 YES NVRAM up up

R1#sh run | i ntp
ntp source FastEthernet0/0
ntp server 10.10.10.1

router ospf 1
log-adjacency-changes
network 10.10.10.0 0.0.0.255 area 0

I dont know what I'm missing. Please assist. Thanks in advance.

[Marvin Rhoads · Accepted solution]

CIsco ASA does not have the ability to act as an ntp master (server). The feature simply does not exist in the software.

You can confirm what ports your ASA is listening on with the command:

show asp table socket

Normally you will see 443 and 22 (for SSL/TLS and SSH connections).

On a side note, it's only when the control-plane keyword is added to the ACL entry that the traffic inspection applies to traffic destined to the ASA. Without the control-plane keyword, the ACL entries will apply to traffic traversing through the ASA.

The control-plane keyword specifies if the extended ACL is for to-the-box traffic.

Source:

http://www.cisco.com/c/en/us/td/docs/security/asa/asa95/configuration/firewall/asa-95-firewall-config/access-rules.html#ID-2124-0000010d