Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Today I noticed that the clock my Cisco ASA 5505 firewall was running about 15 minutes late, which surprised me since I've set up the NTP client.

My two NTP servers 10.10.0.1 and 10.10.0.2 are virtualized Windows Server 2008 R2 domain controllers, and both have the correct time.

As shown below, the ASA knows about the two servers, can ping them and seems to poll them periodically, so I suppose it can reach them both. The ASA claims its time source is NTP, however the clock is unsynchronized. Neither host is marked as synced.

Result of the command: "ping 10.10.0.1"

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.0.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms


Result of the command: "sh ntp ass"

      address         ref clock     st  when  poll reach  delay  offset    disp
 ~10.10.0.1        .LOCL.            1    78  1024  377     0.5  643.69    17.0
 ~10.10.0.2        10.10.0.1         2   190  1024  377     0.9  655.91    58.4
 * master (synced), # master (unsynced), + selected, - candidate, ~ configured


Result of the command: "sh ntp ass detail"

10.10.0.1 configured, insane, invalid, stratum 1
ref ID .LOCL., time d3932559.6aa66707 (19:58:49.416 CEDT Mon Jun 25 2012)
our mode client, peer mode server, our poll intvl 1024, peer poll intvl 1024
root delay 0.00 msec, root disp 10651.84, reach 377, sync dist 10676.743
delay 0.63 msec, offset 625.3783 msec, dispersion 24.60
precision 2**6, version 3
org time d393fc14.b4a24e74 (11:15:00.705 CEDT Tue Jun 26 2012)
rcv time d393fc14.149e12ec (11:15:00.080 CEDT Tue Jun 26 2012)
xmt time d393fc14.1474f384 (11:15:00.079 CEDT Tue Jun 26 2012)
filtdelay =     0.63    0.47    0.63    0.53    0.50    0.35    0.92    0.37
filtoffset =  625.38  629.03  635.65  643.69  644.70  646.06  644.38  642.86
filterror =    15.63   31.25   46.88   54.69   58.59   60.55   61.52   62.26

10.10.0.2 configured, insane, invalid, stratum 2
ref ID 10.10.0.1, time d393fb9b.e810a061 (11:12:59.906 CEDT Tue Jun 26 2012)
our mode client, peer mode server, our poll intvl 1024, peer poll intvl 1024
root delay 31.25 msec, root disp 10756.23, reach 377, sync dist 10796.097
delay 0.53 msec, offset 640.2991 msec, dispersion 22.28
precision 2**6, version 3
org time d393fba4.b872ee34 (11:13:08.720 CEDT Tue Jun 26 2012)
rcv time d393fba4.149a40c6 (11:13:08.080 CEDT Tue Jun 26 2012)
xmt time d393fba4.14765384 (11:13:08.079 CEDT Tue Jun 26 2012)
filtdelay =     0.53    0.64    0.85    0.87    0.61    0.81    0.53    0.73
filtoffset =  640.30  642.79  649.05  655.91  648.54  644.63  634.64  570.58
filterror =    15.63   31.25   46.88   54.69   58.59   60.55   61.52   62.30


Result of the command: "sh ntp stat"

Clock is unsynchronized, stratum 16, no reference clock
nominal freq is 99.9984 Hz, actual freq is 99.9984 Hz, precision is 2**6
reference time is 00000000.00000000 (07:28:16.000 CEST Thu Feb 7 2036)
clock offset is 0.0000 msec, root delay is 0.00 msec
root dispersion is 0.00 msec, peer dispersion is 0.00 msec


Result of the command: "sh clock detail"

10:33:23.769 CEDT Tue Jun 26 2012
Time source is NTP
UTC time is: 08:33:23 UTC Tue Jun 26 2012
Summer time starts 02:00:00 CEST Sun Mar 25 2012
Summer time ends 03:00:00 CEDT Sun Oct 28 2012

I've tried the basic steps of manually setting the time and removing and adding the timeservers, to no avail.

My ASA's ntp config is simply:

ntp server 10.10.0.1
ntp server 10.10.0.2

Do I need to enable authentication to use a Windows NTP server?

Any thoughts?

share|improve this question

2 Answers 2

up vote 4 down vote accepted

Short answer

If you need to sync Cisco boxes to these Win2008 servers, disable the w32time service and install an NTPv4 server for Windows. This is the free Meinberg ntpv4 for windows.

If you don't want to disable w32time for whatever reason, you can host ntpd on a (u|li)nux server, sync that ntpd to an external ntp pool (such as a server from pool.ntp.org), and then point your ASAs to this reference.

Longer answer

This is the key from your info captures above:

10.10.0.1 configured, insane, invalid, stratum 1

Essentially, you might not be able to sync an IOS machine or ASA to a w32time service in Windows; for an authoritative link, see This article on Cisco's support forum.

It is possible to get too much root dispersion in a w32time service. Microsoft also acknowledges this limitation; KB939322 points out that you can only get a couple of seconds of precision from w32time.

A bug was filed against this in IOS years ago and got junked by Cisco.

CSCed13703

Externally found moderate defect: Junked (J) NTP will not sync, flags server as insane, invalid

Release-note:

An IOS system may be unable to synchronize to an NTP server despite being able to transmit to and receive packets from the server. This may be seen with a Windows system running the w32time service.

'show ntp associations detail" will show that the server is flagged as "insane, invalid". The "root dispersion" value will be seen as being in excess of 1000 ms, which will cause the IOS NTP implementation to reject the association.

share|improve this answer
    
Ah. I'm not too familiar with Windows Server. These servers are domain controllers, and I know correct time is important for Kerberos. Anything I should be aware of before I replace the time service? –  Martijn Heemels Jun 26 '12 at 9:52
    
Kerberos works very well with the Meinberg NTP server. Be sure you sync the Meinberg NTP server with an external reference on the internet. There are thousands of free NTP sources available –  Mike Pennington Jun 26 '12 at 9:54
    
What NTP server does your Domain Controller sync with? Set your Cisco boxes to use that too. Preferable to messing with your Domain Controller. –  dunxd Jun 26 '12 at 9:54
    
@dunxd, look at his original question. 10.0.0.1 is free-running, and 10.0.0.2 references 10.0.0.1. –  Mike Pennington Jun 26 '12 at 10:01
    
My suggestion then is rather than tearing out w32time on any DC, decide on an authoritative time source, then sync your DCs to that, and any client that can't sync with the DCs you then point at the same source. The Windows KB article you linked to falls just short of suggesting you sync your Windows server to NIST servers. –  dunxd Jun 26 '12 at 10:23

I would also caution against ripping out the w32time service on your DCs. Every single windows domain machine you have relies on the DCs for time. You're talking about 1 box here.

I've never had issues syncing to a DC for NTP with Cisco gear. I would investigate other avenues first - submit a TAC case for Cisco to investigate, assuming you've got a valid contract. Are you having issues with any Cisco switches/routers you're running? What ASA image are you running?

share|improve this answer
    
    
He's got a point though, it SHOULD work. –  SpacemanSpiff Jun 26 '12 at 12:36
1  
A very plain reading of Cisco's support forums indicates that Cisco may not sync to w32time. Furthermore, look at the Workaround: Instead of running the w32time service on the Windows system, use NTP 4.x –  Mike Pennington Jun 26 '12 at 13:03
1  
If the poster really wants to get away from w32time (again, this setup works just fine elsewhere), how about just use a dummy NTP server elsewhere on your network, and have the ASA sync to that. This way you're not monkeying with a critical service for your domain machines, that as far as we know so far is working fine for the OP. That NTP server can run whatever OS, whatever NTP server implementation, and sync to whatever root desired. Seems much simpler. –  sjw Jun 26 '12 at 14:32
    
@sjw, that's actually the road I went down. Didn't dare to mess with the Windows DC's so installed ntpd on a Linux VM. I also noticed that some Cisco Catalyst switches couldn't sync time with the Windows DC's so I switched all network equipment to the linux ntpd. Seems to work fine now. –  Martijn Heemels Apr 26 at 22:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.