Cisco Systems IPS4510K9 manual Time Sources and the Sensor

Appendix C Troubleshooting

Time Sources and the Sensor

Time Sources and the Sensor

This section describes how to maintain accurate time on the sensor, and contains the following topics:

•Time Sources and the Sensor, page C-15

•Synchronizing IPS Clocks with Parent Device Clocks, page C-15

•Verifying the Sensor is Synchronized with the NTP Server, page C-16

•Correcting Time on the Sensor, page C-16

Time Sources and the Sensor

Note We recommend that you use an NTP server to regulate time on your sensor. You can use authenticated or unauthenticated NTP. For authenticated NTP, you must obtain the NTP server IP address, NTP server key ID, and the key value from the NTP server. You can set up NTP during initialization or you can configure NTP through the CLI, IDM, IME, or ASDM.

The sensor requires a reliable time source. All events (alerts) must have the correct UTC and local time stamp, otherwise, you cannot correctly analyze the logs after an attack. When you initialize the sensor, you set up the time zones and summertime settings. This section provides a summary of the various ways to set the time on sensors.

The IPS Standalone Appliances

•Use the clock set command to set the time. This is the default.

•Configure the appliance to get its time from an NTP time synchronization source.

Note The currently supported Cisco IPS appliances are the IPS 4345, IPS 4360, IPS 4510, and IPS 4520.

The ASA IPS Modules

•The ASA 5500-X IPS SSP and ASA 5585-X IPS SSP automatically synchronize their clocks with the clock in the adaptive security appliance in which they are installed. This is the default.

•Configure them to get their time from an NTP time synchronization source, such as a Cisco router other than the parent router.

For More Information

For the procedure for configuring NTP, see Configuring NTP, page 3-42.

Synchronizing IPS Clocks with Parent Device Clocks

The ASA IPS modules (ASA 5500-X IPS SSP and ASA 5585-X IPS SSP) synchronize their clocks to the parent chassis clock (switch, router, or adaptive security appliance) each time the IPS boots up and any time the parent chassis clock is set. The IPS clock and parent chassis clock tend to drift apart over time. The difference can be as much as several seconds per day. To avoid this problem, make sure that both the IPS clock and the parent clock are synchronized to an external NTP server. If only the IPS clock or only the parent chassis clock is synchronized to an NTP server, the time drift occurs.

	Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01		C-15