Cisco IPS 7.1 Installation Guide download pdf (Page 286)

E-16

Cisco Intrusion Prevention System Appliance Hardware Installation Guide for IPS 7.1

OL-24002-01

Appendix E Troubleshooting

Time Sources and the Sensor

The ASA IPS Modules

• The ASA 5500 AIP SSM, ASA 5500-X IPS SSP, and ASA 5585-X IPS SSP automatically

synchronize their clocks with the clock in the adaptive security appliance in which they are installed.

This is the default.

• Configure them to get their time from an NTP time synchronization source, such as a Cisco router

other than the parent router.

For More Information

For the procedure for configuring NTP, refer to Configuring NTP.

Synchronizing IPS Module Clocks with Parent Device Clocks

The ASA IPS modules (ASA 5500 AIP SSM, ASA 5500-X IPS SSP, and ASA 5585-X IPS SSP)

synchronize their clocks to the parent chassis clock (switch, router, or adaptive security appliance) each

time the IPS boots up and any time the parent chassis clock is set. The IPS clock and parent chassis clock

tend to drift apart over time. The difference can be as much as several seconds per day. To avoid this

problem, make sure that both the IPS clock and the parent clock are synchronized to an external NTP

server. If only the IPS clock or only the parent chassis clock is synchronized to an NTP server, the time

drift occurs.

Verifying the Sensor is Synchronized with the NTP Server

In IPS, you cannot apply an incorrect NTP configuration, such as an invalid NTP key value or ID, to the

sensor. If you try to apply an incorrect configuration, you receive an error message. To verify the NTP

configuration, use the show statistics host command to gather sensor statistics. The NTP statistics

section provides NTP statistics including feedback on sensor synchronization with the NTP server.

To verify the NTP configuration, follow these steps:

Step 1 Log in to the sensor.

Step 2 Generate the host statistics.

sensor# show statistics host

...

NTP Statistics

remote refid st t when poll reach delay offset jitter

11.22.33.44 CHU_AUDIO(1) 8 u 36 64 1 0.536 0.069 0.001

LOCAL(0) 73.78.73.84 5 l 35 64 1 0.000 0.000 0.001

ind assID status conf reach auth condition last_event cnt

1 10372 f014 yes yes ok reject reachable 1

2 10373 9014 yes yes none reject reachable 1

status = Not Synchronized

...

Step 3 Generate the hosts statistics again after a few minutes.

sensor# show statistics host

...

NTP Statistics

remote refid st t when poll reach delay offset jitter

*11.22.33.44 CHU_AUDIO(1) 8 u 22 64 377 0.518 37.975 33.465

LOCAL(0) 73.78.73.84 5 l 22 64 377 0.000 0.000 0.001

ind assID status conf reach auth condition last_event cnt

1 10372 f624 yes yes ok sys.peer reachable 2

2 10373 9024 yes yes none reject reachable 2

1 ... 285 286 287 ... 422

Comments to this Manuals

No comments

Cisco IPS 7.1 Installation Guide Page 286

Comments to this Manuals

Related products and manuals for Networking Cisco IPS 7.1