This may be different on IPSO 4.x, as mine were running 3.x when I
configured NTP this way.
I had the IP380's (v3.8x) pull NTP from the preferred server, and have
them setup to peer off each other (not preferred) just so they stay in
sync for the cluster if for any reason they should lose connectivity to
the main NTP source. All devices behind them use the Nokia IP's for
their NTP sources. (Don't use the VRRP IP, config your 2 NTP sources as
both physical IP's of both Nokia's that are on your local subnet).
Obviously you have to have NTP allowed for this in your Checkpoint
rules.
It worked fine, but the problem I ran into was that the NTP server in
IPSO would frequently stop responding after as short an interval as just
1 or 2 days. Killing the process (it restarts a new one if it's killed)
so a new process is running would clear it up. As a fix, I just ran a
cron job nightly to restart xntpd, which was:
PID=`ps -ax|grep '[x]ntpd'|awk '{print $1}'`
if [ $PID ]
then
kill $PID
fi
If your firewalls have been up for a while, try killing xntpd, let a
fresh one start, and try it again.
Been working for a long time that way on some of my IP380's. Hopefully
IPSO 4.x hasn't removed the ability to use the xnpd server for devices
behind the firewall, but I haven't tested that yet - it may be gone in
new versions. I know that splat can't be used as the ntp server for
devices behind it (as it installs by default off the CD), so when I've
converted from Nokia to splat, I've had to change the NTP config on the
DMZ servers to something else.
Bruce
-----Original Message-----
From: Mailing list for discussion of Firewall-1
[mailto:[EMAIL PROTECTED] On Behalf Of john
maverick
Sent: Monday, November 05, 2007 01:08
To: [email protected]
Subject: [FW-1] Nokia NTP troubleshooting
Hi,
We have a Nokia IP560 which is the NTP server for all the devices in our
network...of late these devices Cisco routers/switches when CLI ed for
NTP
satus show the clocks are off sync.
The NTP on IP560 hooks onto NTP server in the internet
Other than Sh ntp server and active,debug -x 123 ..is there anything
else
which can throw light on as to why the devices are not synchronising
with
the IP560.
Appreciate help
Thanks all
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[EMAIL PROTECTED]
=================================================
*************************************************************************
The information contained in this communication is confidential, is
intended only for the use of the recipient named above, and may be
legally privileged.
If the reader of this message is not the intended recipient, you are
hereby notified that any dissemination, distribution or copying of this
communication is strictly prohibited.
If you have received this communication in error, please resend this
communication to the sender and delete the original message or any copy
of it from your computer system.
Thank you.
*************************************************************************
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[EMAIL PROTECTED]
=================================================
