Cisco IPS-4255-K9 Installation Guide - Page 295

Chapter A Troubleshooting Time and the Sensor Note Be sure to set the time zone and summertime settings on both the parent router and the AIM IPS and the NME IPS to ensure that the UTC time settings are correct. The local time of the AIM IPS and the NME IPS could be incorrect if the time zone and/or summertime settings do not match between the AIM IPS and the NME IPS and the router. • Configure the AIM IPS and the NME IPS to get their time from an NTP time synchronization source, such as a Cisco router, other than the parent router. The AIP SSM • The AIP SSM automatically synchronizes its clock with the clock in the adaptive security appliance in which it is installed. This is the default. • Configure the AIP SSM to get its time from an NTP time synchronization source, such as a Cisco router other than the parent router. For More Information For the procedure for configuring NTP, refer to Configuring NTP. Synchronizing IPS Module Clocks with Parent Device Clocks All IPS modules (AIM IPS, AIP SSM, IDSM2, and NME IPS) synchronize their system clocks to the parent chassis clock (switch, router, or security appliance) each time the module boots up and any time the parent chassis clock is set. The module clock and parent chassis clock tend to drift apart over time. The difference can be as much as several seconds per day. To avoid this problem, make sure that both the module clock and the parent clock are synchronized to an external NTP server. If only the module clock or only the parent chassis clock is synchronized to an NTP server, the time drift occurs. Verifying the Sensor is Synchronized with the NTP Server In IPS, you cannot apply an incorrect NTP configuration, such as an invalid NTP key value or ID, to the sensor. If you try to apply an incorrect configuration, you receive an error message. To verify the NTP configuration, use the show statistics host command to gather sensor statistics. The NTP statistics section provides NTP statistics including feedback on sensor synchronization with the NTP server. To verify the NTP configuration, follow these steps: Step 1 Step 2 Log in to the sensor. Generate the host statistics. sensor# show statistics host ... NTP Statistics remote refid st t when poll reach delay 11.22.33.44 CHU_AUDIO(1) 8 u 36 64 1 0.536 LOCAL(0) 73.78.73.84 5 l 35 64 1 0.000 ind assID status conf reach auth condition last_event cnt 1 10372 f014 yes yes ok reject reachable 1 2 10373 9014 yes yes none reject reachable 1 status = Not Synchronized ... offset jitter 0.069 0.001 0.000 0.001 OL-18504-01 Cisco Intrusion Prevention System Appliance and Module Installation Guide for IPS 7.0 A-17