1-23
Cisco Intrusion Prevention System Appliance and Module Installation Guide for IPS 7.1
OL-24002-01
Chapter 1 Introducing the Sensor
Time Sources and the Sensor
•
Correcting the Time on the Sensor, page 1-24
The Sensor and Time Sources
Note
We recommend that you use an NTP server to regulate time on your sensor. You can use authenticated
or unauthenticated NTP. For authenticated NTP, you must obtain the NTP server IP address, NTP server
key ID, and the key value from the NTP server. You can set up NTP during initialization or you can
configure NTP through the CLI, IDM, IME, or ASDM.
The sensor requires a reliable time source. All events (alerts) must have the correct UTC and local time
stamp, otherwise, you cannot correctly analyze the logs after an attack. When you initialize the sensor,
you set up the time zones and summertime settings. This section provides a summary of the various ways
to set the time on sensors.
The IPS Standalone Appliances
•
Use the
clock set
command to set the time. This is the default.
•
Configure the appliance to get its time from an NTP time synchronization source.
Note
The currently supported Cisco IPS appliances are the IPS 4240, IPS 4255, and IPS 4260 [IPS
7.0(x) and later and IPS 7.1(5) and later], IPS 4270-20 [IPS 7.1(3) and later], IPS 4345 and
IPS 4360 [IPS 7.1(3) and later], and IPS 4510 and IPS 4520 [IPS 7.1(4) and later].
The ASA IPS Modules
•
The ASA 5500-X IPS SSP and ASA 5585-X IPS SSP automatically synchronize their clocks with
the clock in the adaptive security appliance in which they are installed. This is the default.
•
Configure them to get their time from an NTP time synchronization source, such as a Cisco router
other than the parent router.
Synchronizing IPS Module System Clocks with the Parent Device System Clock
The ASA IPS modules (ASA 5500 AIP SSM, ASA 5500-X IPS SSP, and ASA 5585-X IPS SSP)
synchronize their clocks to the parent chassis clock (switch, router, or adaptive security appliance) each
time the IPS boots up and any time the parent chassis clock is set. The IPS clock and parent chassis clock
tend to drift apart over time. The difference can be as much as several seconds per day. To avoid this
problem, make sure that both the IPS clock and the parent clock are synchronized to an external NTP
server. If only the IPS clock or only the parent chassis clock is synchronized to an NTP server, the time
drift occurs.
Verifying the Sensor is Synchronized with the NTP Server
In the Cisco IPS, you cannot apply an incorrect NTP configuration, such as an invalid NTP key value or
ID, to the sensor. If you try to apply an incorrect configuration, you receive an error message. To verify
the NTP configuration, use the
show statistics
host
command to gather sensor statistics. The NTP
statistics section provides NTP statistics including feedback on sensor synchronization with the NTP
server.
