Re: [FW-1] Time synch

[Alexander Hoogerhuis <alexh@FW1-NOSPAMIHATENT.COM>]

"La Coursiere, Jeff" <Jeff.LaCoursiere@T-MOBILE.NET> writes:

> Hi All,
>
> Noticed today that our office firewall was not setup to synch its
> time to our NTP server, and was off by about 7 minutes.  When we
> setup xntpd a number of our VPNs crashed.  Assumed this was due to
> SAs expiring or something, and they came back to life on their own a
> while later.
>
> Since then I did a quick inventory on the remote firewalls and one
> that has not been touched in almost two years is actually off by 1.5
> hours!  I am now very afraid to touch its clock, let alone setup
> time synch on it.  Has anyone any experience resetting clocks on VPN
> boxes?  Some advice, please :)
>

Assuming this is a sensible UNIX setup, it should only run ntpdate on
boot, and not if started at runtime. What probably happened was that
your machine did a "rdate" or "ntpdate" while starting the service,
and this cause time to reverse, which would trigger all kinds of
wonderous fun with regards to anti-replay functions in IPSec.

If it had started without forcing the time right time on the machine,
and let it drift into sync, time would be continuous and increasing;
it would have slowed or sped the machine's time to slowly concur with
actual time.

> Thanks,
>
> Jeff LaCoursiere
> Infrastructure Specialist
> TMIUK
>

mvh,
A
--
Alexander Hoogerhuis                               | alexh@ihatent.com
CCNP - CCDP - MCNE - CCSE                          | +47 908 21 485
"You have zero privacy anyway. Get over it."  --Scott McNealy

=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to LISTSERV@amadeus.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.checkpoint.com
=================================================