3-36
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter 3 Setting Up the Sensor
Configuring Time
The ASA IPS Modules
•
The ASA 5500-X IPS SSP and ASA 5585-X IPS SSP automatically synchronize their clocks with
the clock in the adaptive security appliance in which they are installed. This is the default.
•
Configure them to get their time from an NTP time synchronization source, such as a Cisco ro uter
other than the parent router.
Synchronizing IPS Module System Clocks with the Parent Device System Clock
The ASAIPS modules (ASA 5500 AIP SSM, ASA 5500-X IPS SSP, ASA5585-X IPS SSP) synchronize
their clocks to the parent chassis clock (switch, router, or adaptive security appliance) each time the IPS
boots up and any time the parent chassis clock is set. The IPS clock and parent chassis c lock tend to drift
apart over time. The difference can be as much as several seconds per day. To avoid this problem, make
sure that both the IPS clock and the parent clock are synchronized to an external NTP server. If only the
IPS clock or only the parent chassis clock is synchronized to an NTP server, the time drift occurs.
Correcting Time on the Sensor
If you set the time incorrectly, your stored events will have the incorrect time because they are stamped
with the time the event was created. The Event Store time stamp is always based on UTC time. If during
the original sensor setup, you set the time incorrectly by specifying 8:00 p.m. rather than 8:00a.m.,
when you do correct the error, the corrected time will be set backwards. New events might have times
older than old events.
For example, if during the initial setup, you configure the sensor as central time with daylight saving
time enabled and the local time is 8:04 p.m., the time is displayed as 20:04:37 CDT and has an offset
from UTC of -5 hours (01:04:37 UTC, the next day). A week later at 9:00 a.m., you discover the error:
the clock shows 21:00:23 CDT. You then change the time to 9:00 a.m. and now the clock shows
09:01:33 CDT. Because the offset from UTC has not changed, it requires that the UTC time now be
14:01:33 UTC, which creates the time stamp problem.
To ensure the integrity of the time stamp on the event records, you must clear the event archive of the
older events by using the clear events command.
Note
You cannot remove individual events.
Configuring Time on the Sensor
This section describes how to configure time on the sensor so that your events are time-stamped
correctly. It contains the following topics:
•
Displaying the System Clock, page 3-37
•
Manually Setting the System Clock, page 3-37
•
Configuring Recurring Summertime Settings, page 3-38
•
Configuring Nonrecurring Summertime Settings, page 3-40
•
Configuring Time Zones Settings, page 3-42