topic Re: effect of using nl.pool.ntp.org as domain object in Firewall and Security Management

effect of using nl.pool.ntp.org as domain object

Hugo_vd_Kooij — Thu, 09 Jun 2022 10:54:30 GMT

We have a customer that asked to allow NTP to nl.pool.ntp.iorg but that pool is rather big so the FQDN result will vary a lot over the course of a day. Nut sure if that will cause issues where a device will be in NTP sync for a few hours but then run into sync issues do to the varying nature of the results.

Has anyone done this before? Or should I juist put any in the destion and accept that NTP traffic may go all ove the place?

Any thoughts on this?

Regards, Hugo.

Re: effect of using nl.pool.ntp.org as domain object

Hugo_vd_Kooij — Thu, 09 Jun 2022 10:57:56 GMT

Using a Country as destination might be another way to limit that scope without it becoming impractical in terms of management or security.

Re: effect of using nl.pool.ntp.org as domain object

Nik_Bloemers — Thu, 09 Jun 2022 12:33:01 GMT

Hi Hugo,

I've recently made a rule for the domain object .pool.ntp.org
It seems to work just fine.

Nik

Re: effect of using nl.pool.ntp.org as domain object

Wolfgang — Fri, 10 Jun 2022 12:01:36 GMT

FQDN domain objects are a really nice feature and we are happy to use them. No problem with changes of the records. The gateway follows the TTL of the DNS records and too updates the FQDN object every 60min and with policy install.

See Domain Objects in R8x and How do Domain Objects work?

With Domains Tool (domains_tool) you can check the actual information in the gateways cache.

No worry using these objects.

Re: effect of using nl.pool.ntp.org as domain object

Vladimir — Fri, 10 Jun 2022 16:35:55 GMT

@Hugo_vd_Kooij , There is got to be some serious drift on devices in question for this situation to have material effect. Generally, if situation warrants high-precision timekeeping, I'd suggest having an on-premises time server (even software-based https://www.meinbergglobal.com/english/sw/) and use external servers only as references for those.