Cisco Systems IPS4520K9 manual Synchronizing IPS Module Clocks with Parent Device Clocks

Appendix E Troubleshooting

Time Sources and the Sensor

The IPS Standalone Appliances

•Use the clock set command to set the time. This is the default.

•Configure the appliance to get its time from an NTP time synchronization source.

Note The currently supported Cisco IPS appliances are the IPS 4240, IPS 4255, and IPS 4260 [IPS 7.0(x) and later and IPS 7.1(5) and later], IPS 4270-20 [IPS 7.1(3) and later], IPS 4345 and IPS 4360 [IPS 7.1(3) and later], and IPS 4510 and IPS 4520 [IPS 7.1(4) and later].

The ASA IPS Modules

•The ASA 5500-X IPS SSP and ASA 5585-X IPS SSP automatically synchronize their clocks with the clock in the adaptive security appliance in which they are installed. This is the default.

•Configure them to get their time from an NTP time synchronization source, such as a Cisco router other than the parent router.

For More Information

For the procedure for configuring NTP, refer to Configuring NTP.

Synchronizing IPS Module Clocks with Parent Device Clocks

The ASA IPS modules (ASA 5500-X IPS SSP and ASA 5585-X IPS SSP) synchronize their clocks to the parent chassis clock (switch, router, or adaptive security appliance) each time the IPS boots up and any time the parent chassis clock is set. The IPS clock and parent chassis clock tend to drift apart over time. The difference can be as much as several seconds per day. To avoid this problem, make sure that both the IPS clock and the parent clock are synchronized to an external NTP server. If only the IPS clock or only the parent chassis clock is synchronized to an NTP server, the time drift occurs.

Verifying the Sensor is Synchronized with the NTP Server

In IPS, you cannot apply an incorrect NTP configuration, such as an invalid NTP key value or ID, to the sensor. If you try to apply an incorrect configuration, you receive an error message. To verify the NTP configuration, use the show statistics host command to gather sensor statistics. The NTP statistics section provides NTP statistics including feedback on sensor synchronization with the NTP server.

To verify the NTP configuration, follow these steps:

Step 1	Log in to the sensor.
Step 2	Generate the host statistics.
	sensor# show statistics host
	...
	NTP Statistics
	remote	refid	st t when poll reach					delay	offset	jitter
	11.22.33.44	CHU_AUDIO(1)	8	u	36	64	1	0.536	0.069	0.001
	LOCAL(0)	73.78.73.84	5	l	35	64	1	0.000	0.000	0.001

	ind assID status			conf reach auth condition				last_event cnt
1		10372	f014	yes	yes	ok	reject	reachable	1
2		10373	9014	yes	yes	none	reject	reachable	1
	status = Not Synchronized
			Cisco Intrusion Prevention System Appliance and Module Installation Guide for IPS 7.1
	OL-24002-01									E-15