How to Configure Clock and NTP on Cisco ASA 5500
The Cisco ASA appliance retains clock settings in memory via a battery on the device motherboard. Even if the device is turned off, the clock is retained in memory. Configuring accurate time settings on the appliance is important for logging purposes since syslog messages can contain a time stamp according to the device clock time setting. If you want the syslog messages to include a time-stamp value, you must first configure the clock (using clock set command) and then enable time-stamps using logging timestamp command (more on syslog configuration in later sections). Having a time-stamp value on log messages is important for event tracing and forensic purposes when a security incident occurs.
Another important reason for setting the correct time on the ASA firewall is when you use PKI (Public Key Infrastructure) with digital certificates for authentication of IPSEC VPN peers. The ASA firewall uses the local appliance clock to make sure that a Digital Certificate is not expired. When using PKI digital certificates, set the firewall clock to UTC time zone.
Configure Clock Settings:
To configure the clock settings of the ASA appliance, use the clock set command as shown below:
ciscoasa# clock set hh:mm:ss [day month | month day] year
Example:
ciscoasa# clock set 18:30:00 Apr 10 2009
To verify the correct clock on the appliance, use the show clock command.
Configure Time Zone and Daylight Saving Time:
To configure the time zone and the summer daylight saving time use the commands below:
ciscoasa# config t
ciscoasa(config)# clock timezone [zone name] [offset hours from UTC]
ciscoasa(config)# clock summer-time [zone name] recurring [week weekday month hh:mm week weekday month hh:mm] [offset]
Example:
ciscoasa(config)# clock timezone MST -7
ciscoasa(config)# clock summer-time MST recurring 1 Sunday April 2:00 last Sunday October 2:00
Configure Network Time Protocol (NTP):
If there is an NTP server in the network that provides accurate clock settings, then you can configure the firewall to synchronize its time with the NTP server. Both an authenticated and non-authenticated NTP is supported:
Non-Authenticated NTP:
ciscoasa(config)# ntp server [ip address of NTP] source [interface name]
Example:
ciscoasa(config)# ntp server 10.1.23.45 source inside
Authenticated NTP:
ciscoasa(config)# ntp authenticate
ciscoasa(config)# ntp authentication-key [key ID] md5 [ntp key]
ciscoasa(config)# ntp trusted-key [key ID]
ciscoasa(config)# ntp server [ip address of NTP] key [key ID] source [intf name]
Example:
ciscoasa(config)# ntp authenticate
ciscoasa(config)# ntp authentication-key 32 md5 secretkey1234
ciscoasa(config)# ntp trusted-key 32
ciscoasa(config)# ntp server 10.1.2.3 key 32 source inside
Related posts:
- How to Configure SNMP on Cisco ASA 5500 Firewall
- How To Configure AnyConnect SSL VPN on Cisco ASA 5500
- Configure Static Routing on Cisco ASA Firewall
- Cisco Router with Cisco ASA for Internet Access
- Password Recovery for the Cisco ASA 5500 Firewall
Tagged with: how to configure clock • how to configure ntp on cisco asa
Filed under: Cisco ASA Configuration
Like this post? Subscribe to my RSS feed and get loads more!
I have the NTP set up in my 5505 so that it can update as a client, But getting the server part established is giving me some issues. I have multiple subnets and am using several ports. Also since the IP addresss being assigned as an NTP server on the ASA isn’t an actual machine, do you have ideas on weather an exempt NAT or ACL is needed?
One would think that the Cisco engineers would have it so the ASA could take into account if your setting it up as a NTP server to permit those requests from accociated interfaces.
As far as I know, you don’t need to configure any nat exemption or ACL. What is your exact configuration on the ASA ?