FTD 2100 NTP timezone issue

[Ajay Saini]

Hello,

We have HA pair of 2100 FTD appliances managed by VFMC running version 6.2.2.109. The issue is related to NTP. The FMC is pointed to our internal NTP server and is showing correct time and timezone.

The issue is with FTD appliances which are getting the UTC time but not taking the timezone. We have tried both options  from the platform settings - using FMC and pointing to NTP server but does not work.

Is there a way to fix the timezone issue.

Thanks in advance.

AJ

[mikael.lahtela]

Hi,

Where do you see the UTC time on the FTD?
In cli you will always see UTC time and that is the way it works.
Here is a Firepower doc about troubleshooting NTP.
https://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118626-technote-firesight-00.html

br, Micke

[Ajay Saini]

Hello Mikael,

Thanks for the clarification, thats what I wanted to check. The syslogs has the correct timestamp, only the cli on FTD has UTC.

Thanks,

AJ

[yogdhanu · Accepted solution]

Hi Ajay,

CLI of FTD or FMC for that matter will be in UTC only. That's because of internal DB level communication of processes and designed that way. It does not affect user experience in terms of logs which can be in your time zone based on configuration on FMC GUI.

Please DO NOT change the CLI time zone from UTC on any of firepower products. That might end up corrupting the database and only way to fully recover from that could be to re-image the device.

Hope it helps,

Yogesh

[Ajay Saini]

Thanks Yogesh for the info. I think we are all set with the info provided by you and Mikael.

-

AJ

[ccna_security]

Dear all. I configured correlation policy and started to collect logs. Moreover i configured that when correlation event happen firepower must send it via email. Actually everything worked correctly. Except one thing that related to  timing. I got correlation event via email it shown that correlation had happened at 06.32 am but when i entered FMC and observed that correlation actually happened at  10.32am. I am sure that FMC shows correct time because i tested it. i created correlation event on purpose and FMC shown correct time. But email didnt. Hope you understood what kind of issue i have faced. Please if possible help me to solve this problem. thanks in advance.

[Marvin Rhoads]

Check the timezone on your FMC. It is probably set to 4 hours offset from UTC/GMT.

[ccna_security]

Hi MArvin 

Sorry for late reply. I am going to check timezone on FMC. Thank you so much

[HakamAbd79366]

Dear All,

Timezone at FMC is correct when i configure System>Configuration>Time Synch.

But when i go to device>device management > Device. it show wrong timezone UTC (UTC+0:00). And i go to Platform setting>Time Synchronization set my clock Via NTP from Management Center. also got timezone UTC+0:00. and change to Via NTP from (same with FMC) .. but still have got timezone UTC+0:00... Its possible to change this timezone.?

Please advise.

Thanks

[OleksandrVasyniuk87346]

Hi All,

You must go to the menu under the username in the upper left corner of the FMC GUI.

Then click User Preference -> In the Time Zone menu, select your own zone.

[mustafa83]

luckily you guys are working for Cisco so things can be "designed" as you pleased because such design won't last a week in a company where designing has to make sense.

[RSporbert]

Cannot like this observation enough

[SHABEEB KUNHIPOCKER]

Hi Guys,

I just wanted to know if there has been any enhancement on this or still we cannot change the FTD CLI time zone?. I tried to configure the timezone option in platform settings but still the CLI command "show clock" is showing the UTC timezone. Please confirm.

[Marvin Rhoads]

@SHABEEB KUNHIPOCKER go to expert mode and use the "date" command to see the configured timezone. Note that even when it is set to a non-default value, events and syslog messages will still be in UTC.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwh84277