Hi

But configuring public ntp servers on all devices is a security hole, can I configure my Internet routers as public ntp servers and for rest of devices these routers will be ntp server.

Regards/Asfar

Asfar, your idea is good. Depending on the size of the private network you might want to use NTP servers per location or per distribution block - Make it a hierarchy, with the top most being your internet facing routers.

Back to the problem though... Are your internet facing routers sucessfully syncing with external NTP sources? Is it just your internal IOS devices that can't sync? I have a similar setup with my internet facing router configured with 3 public NTP servers and then my internal IOS devices configured to sync from my router (it's a small network so no multi-layered hierarchy).

HTH

Andy

Hi Andy

I have a large network existing of 8 firewalls , 2 x 6509 Core switches , 56 x Access Switches and comprising of more than 30 VLANs , for this network I have to deploy standalone MARS Server but the first basic thing is to sync every network device , my 2 x Internet Perimeter Routers are synced with the 3 external NTP servers , now I dont want my other devices to go out Internet to sync NTP.

Any advice how to achieve that and if I will sync my Internal IOS devices to the Internet Router ; how to achieve it , can you send me the set of commands used.

I have no objection in setting my Internet routers to go out to Internet and synced with External NTP Source but I dont want other devices to do so.

Regards/Asfar

Asfar, Based on that equipment list it sounds like you have a collapsed Core/Distribution model with access switches connected back to the core using 802.1q trunks? If that's the case I would sync the two core 6509's to the Internet facing routers and then peer them together:

!Core #1

ntp server 10.1.1.1 (Internet Facing Router #1)

ntp server 10.1.2.1 (Internet Facing Router #2)

ntp peer 10.10.10.10 (Core 6509 #2)

ntp source loopback 0

!Core #2

ntp server 10.1.1.1 (Internet Facing Router #1)

ntp server 10.1.2.1 (Internet Facing Router #2)

ntp peer 10.10.10.20 (Core 6509 #1)

ntp source loopback 0

You should then point all your access switches to the two 6500's:

ntp server 10.10.10.20 (Core 6509 #1)

ntp server 10.10.10.10 (Core 6509 #2)

Unless you want to perform any NTP authentication that should be it. If it isn't working you need work backwards and verify each part is working - i.e. are the Internet facing routers sync'd? Then move on to the 6500's, the the access switches.

If the 6500's aren't sync'd you need to verify they can reach the routers and UDP 123 is allowed (it could be a firewall issue as I assume there are firewalls between the Internet facing routers and the 6500's?)

The reason for the loopbacks is they are predictable, stable interfaces and I would recommend tying all your management protocols to loopbacks on Layer-3 IOS devices.

HTH

Andy

Andy , what about firewalls they will also sync'd with the core switches or Internet Router.

Yes, sync the firewalls off the core switches. Bear in mind the PIX & ASA will physically try and send the NTP packets out of the interface if you include this in the configuration:

ntp server 10.1.1.1 source inside

This is unlike the behaviour of an IOS router which will just set the source IP address of the packets.

HTH

Andy