Re: RE: [fw-wiz] Acqusition of time

From: Joseph S D Yao (jsdy@center.osis.gov)
Date: 01/30/03 

From: Joseph S D Yao <jsdy@center.osis.gov>
To: "Paul D. Robertson" <proberts@patriot.net>
Date: Thu Jan 30 15:48:55 2003

On Wed, Jan 29, 2003 at 12:29:56PM -0500, Paul D. Robertson wrote:
> On Wed, 29 Jan 2003, Brian Monkman wrote:
>
> > Ok - so something more specific this time.
> >
> > We are talking about a firewall farm. We want the time to be sync'ed
> > between all of the firewalls. Logs go to a central logging server.
> > Reason for the sync'ing, to ensure that time is accurate across all of
> > the firewalls in order to facilitate forensics and event correlation.
> >
> > In your opinion - should we have a battery backed-up clock on these
> > firewalls or is the network time source sufficient?
>
> If the criterion is that the firewalls be synchronized to some standard,
> then I suppose the real issue is what happens if a single firewall is
> rebooted and unable to reach either the time server or the logging server
> (if it's syslog, you don't even know you didn't get there?)
>
> (UDP-based syslogs were heavily affected by SQL-Slammer for instance.)
>
> Battery back-up helps for the reboot instance, and (potentially, though
> not normally) for the timeserver goes down instance. If there's defined
> behaviour for "system rebooted and couldn't reach the timeserver" and it's
> materially seperable from "just after midnight," then I don't suppose
> there's much of an issue, you can put things back together by deltaing
> once you do get reliable time information.

Battery back-up clocks MUST periodically have the network-based time
written into them! Otherwise, when the system re-boots, you get the
battery back-up clock's time, whatever it might just happen to be!

Most battery hardware clocks aren't very expensive, so this seems like
a cheap and reasonable backup to syncing off the NTP source(s). 

--
Joe Yao				jsdy@center.osis.gov - Joseph S. D. Yao
OSIS Center Systems Support					EMT-B
-----------------------------------------------------------------------
	    PLEASE ... send or Cc: all "OSIS Systems Support"
		     mail to sys-adm@center.osis.gov
-----------------------------------------------------------------------
   This message is not an official statement of OSIS Center policies.

Relevant Pages

  • Re: RE: [fw-wiz] Acqusition of time
    ... Logs go to a central logging server. ... > the firewalls in order to facilitate forensics and event correlation. ... Battery back-up helps for the reboot instance, and (potentially, though ... not normally) for the timeserver goes down instance. ...
    (Firewall-Wizards)
  • Re: [fw-wiz] Acqusition of time
    ... If a security device uses network time and can't set the clock there needs ... to be a capability to drop the Firewall into a blocking mode. ... Logs go to a central logging server. ... >> the firewalls in order to facilitate forensics and event correlation. ...
    (Firewall-Wizards)
  • Re: ZoneAlarm Pro looses Settings
    ... > Frustrated ZoneAlarm wrote: ... Reboot into safe mode. ... Reboot into normal windows. ... manager or close program window for all major firewalls i will really ...
    (comp.security.firewalls)
  • Re: Newbie Networking Problem - Step by Step guide Needed Please
    ... Did you reboot after the change? ... One other thing - turn all firewalls off and then logon to Internet and run ...
    (microsoft.public.windowsxp.network_web)
  • Re: Newbie Networking Problem - Step by Step guide Needed Please
    ... Did you reboot after the change? ... One other thing - turn all firewalls off and then logon to Internet and run ...
    (microsoft.public.windowsxp.setup_deployment)