Cisco IPS-4255-K9 Installation Guide - Page 44

Time Sources and the Sensor Chapter 1 Introducing the Sensor The NME IPS installs in any slot in the 2800 and 3800 series access routers. Figure 1-10 shows the NME IPS. Figure 1-10 NM-CIPS NME IPS MODULE LINK DUPLEX SYS EN 191864 For More Information • For a list of supported router and NME IPS combinations, see Software and Hardware Requirements, page 8-2. • For information on installing the NME IPS, see Installation and Removal Instructions, page 8-5. • For more information about sessioning to the NME IPS, see Logging In to the NME IPS, page 9-9. • For more information on configuring the NME IPS, refer to Configuring the NME IPS. Time Sources and the Sensor This section explains the importance of having a reliable time source for the sensors and how to correct the time if there is an error. It contains the following topics: • The Sensor and Time Sources, page 1-26 • Synchronizing IPS Module System Clocks with the Parent Device System Clock, page 1-28 • Verifying the Sensor is Synchronized with the NTP Server, page 1-28 • Correcting the Time on the Sensor, page 1-29 The Sensor and Time Sources The sensor requires a reliable time source. All events (alerts) must have the correct UTC and local time stamp, otherwise, you cannot correctly analyze the logs after an attack. When you initialize the sensor, you set up the time zones and summertime settings. Note We recommend that you use an NTP server. You can use authenticated or unauthenticated NTP. For authenticated NTP, you must obtain the NTP server IP address, NTP server key ID, and the key value from the NTP server. You can set up NTP during initialization or you can configure NTP through the CLI, IDM, IME, or ASDM. 1-26 Cisco Intrusion Prevention System Appliance and Module Installation Guide for IPS 7.0 OL-18504-01