1-14
Installing Cisco Intrusion Prevention System Appliances and Modules 5.0
78-16124-01
Chapter 1 Introducing the Sensor
Time Sources and the Sensor
Time Sources and the Sensor
This section explains the importance of having a reliable time source for the sensors and how to correct
the time if there is an error. It contains the following topics:
•
Understanding Time on the Sensor, page 1-14
•
Correcting the Time on the Sensor, page 1-16
Understanding Time on the Sensor
The sensor requires a reliable time source. All events (alerts) must have the correct UTC and local time
stamp, otherwise, you cannot correctly analyze the logs after an attack. When you initialize the sensor,
you set up the time zones and summertime settings. for more information, see
Initializing the Sensor,
page 9-2
.
Here is a summary of ways to set the time on sensors:
•
For appliances
–
Use the clock set command to set the time. This is the default.
For the procedure, refer to
Manually Setting the Clock
.
–
Use NTP
You can configure the appliance to get its time from an NTP time synchronization source. For
the procedure, refer to
Configuring a Cisco Router to be an NTP Server.
You will need the NTP
server IP address, the NTP key ID, and the NTP key value. You can set up NTP on the appliance
during initialization or you can configure NTP through the CLI, IDM, or ASDM.
Note
We recommend that you use an NTP time synchronization source.
•
For IDSM-2
–
IDSM-2 can automatically synchronize its clock with the switch time. This is the default.
Note
The UTC time is synchronized between the switch and IDSM-2. The time zone and
summertime settings are not synchronized between the switch and IDSM-2.
Caution
Be sure to set the time zone and summertime settings on both the switch and IDSM-2 to ensure that the
UTC time settings are correct. The local time of IDSM-2 could be incorrect if the time zone and/or
summertime settings do not match between IDSM-2 and the switch.
