Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Can't access NTP server through PIX 501

Hello all,

My problem is that I can't access any NTP server through the PIX. However, the PIX can access the same server just fine using its internal NTP client. Any ideas? I have tried various access rules but no success yet. My config is:

: Saved

: Written by enable_15 at 18:30:36.546 EEST Tue Feb 12 2008

PIX Version 6.3(5)

interface ethernet0 auto

interface ethernet1 100full

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password xxx encrypted

passwd iii encrypted

hostname pixfirewall


clock timezone EEST 2

clock summer-time EEDT recurring last Sun Mar 3:00 last Sun Oct 4:00

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69


access-list outside_access_in permit icmp any any echo-reply

access-list outside_access_in permit tcp any interface outside eq 2600

access-list outside_access_in permit tcp any interface outside eq ident

access-list outside_access_in permit tcp any interface outside eq 6283

no pager

mtu outside 1500

mtu inside 1500

ip address outside dhcp setroute

ip address inside

ip audit info action alarm

ip audit attack action alarm

pdm location inside

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 0 0

static (inside,outside) tcp interface 2600 ssh netmask 0 0

static (inside,outside) tcp interface ident ident netmask 0 0

static (inside,outside) tcp interface 6283 www netmask 0 0

access-group outside_access_in in interface outside

timeout xlate 0:05:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout sip-disconnect 0:02:00 sip-invite 0:03:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ max-failed-attempts 3

aaa-server TACACS+ deadtime 10

aaa-server RADIUS protocol radius

aaa-server RADIUS max-failed-attempts 3

aaa-server RADIUS deadtime 10

aaa-server LOCAL protocol local

aaa authentication ssh console LOCAL

http server enable

http inside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

telnet timeout 5

ssh inside

ssh timeout 15

console timeout 0

dhcpd address inside

dhcpd lease 3600

dhcpd ping_timeout 750

dhcpd auto_config outside

dhcpd enable inside

username xxx password yyy encrypted privilege 15

terminal width 80


: end

With Best Regards,


Hall of Fame Super Silver

Re: Can't access NTP server through PIX 501


Try adding this to your config:

access-list outside_access_in permit udp any interface outside eq ntp




Re: Can't access NTP server through PIX 501

"access-list outside_access_in permit udp any interface outside eq ntp"

This acl is NOT needed. The current

configuration is perfectly capable of

allowing outbound NTP (udp port 123) by


I would suggest you use capture command to

troubleshoot this.

CCIE Security

New Member

Re: Can't access NTP server through PIX 501

I did some tests with capture, and it seems that when PIX sends the NTP request, it does so with source port of 123 and all goes well. But when the inside host sends the request, then the source port becomes something else and the reply is never received. It seems very likely that ISP blocks the reply packet in that case.

That arises a question, is there a way to create a static/nat so that the source port is not changed (even if only one host would then be able to use NTP)?

With Best Regards,


Cisco Employee

Re: Can't access NTP server through PIX 501

PAT randomises the port

In case you need to preserve the port you may use static 1-to-1

If in the packet captures you don't see a reply packet back on the outside interface it clearly suggest your ISP blocking that traffic

CreatePlease to create content