NTP Server

[Erakul_Siddhart]

Can anyone explain clear about NTP server in checkpoint, how it's getting synchronization with other server time?. Also Share the steps to proceed in GUI and command which used in CLI for clear understanding.

[Mark_Mitchell]

Hi Erakul, 

The Check Point gateway itself doesn't act as an NTP server itself but does sync with other time sources to maintain it's time. 

Is your question "How does Check Point appliances sync with an NTP Server?"

Also would be good to know what version and hardware you are running then we can advise specifically. 

Regards

Mark

[Erakul_Siddhart]

Hi Mark, Thank you for your answer.

Actually I want know about indeed concept of NTP server, like main reason for NTP sever, how its getting work, sync concepts, where and all it will get effect suppose NTP no working?.

 Can you help me in this kind of case.

[1212akil]

Checkpoint pb-20, is it possible to sync NTP time with it

[Lesley]

GAIA os can sync time with other NTP servers, it cannot be NTP itself:

Important Note: You can configure Gaia OS only as an NTP Client. -> https://support.checkpoint.com/results/sk/sk83820

Syntax

• To add a new NTP server:

  set ntp

        active {on | off}

        server

              primary <IPv4 address or Hostname of NTP Server> version {1|2|3|4}

              secondary <IPv4 address or Hostname of NTP Server> version {1|2|3|4}

• To show NTP configuration:

  show ntp

        active

        current

        servers

• To delete an NTP server:

  delete ntp server <IPv4 address or Hostname of NTP Server>

[1212akil]

Hey, we have a checkpoint PB-20 model 5100, does that support NPT sync

[G_W_Albrecht]

• sk32027: NTP Server support on Gaia and SecurePlatform OS
• sk92379: How to configure NTP authentication on Gaia OS / IPSO OS
• sk92378 - How to configure NTP authentication in Gaia
• sk92602 - How to troubleshoot NTP on Gaia OS

[Erakul_Siddhart]

Hi Gunther, Thank you for your valuable reference for NTP.

Can you help me out for one more action, for some instead id like sk32027 telling like "To view this solution, Advanced access is required." what I want to do in this kind of case.

[Jerry]

see WebUI TimeServer section. Place an external or internal NTP host and wait

on CLI (expert mode) you can always query localhost like that

ntpq -pn

this will show you whether the host is syncing-up or not

[Erakul_Siddhart]

Hi Jerry, Thank You.

"Place an external or internal NTP host and wait " -  can you able to explain this briefly. Because I have no clear idea about NTP server how its working and synchronization with other system server.

[Jerry]

That's fine.

you need to place IP addresses into the field by WebUI section.

when you do that SYNC from Check Point device towards local IP address of your locally-hosted NTP server that sync does not leave your network,

when you do that SYNC from Check Point device towards external IP address ie. 195.66.241.10 - that is an external public (well known and with good reliability) NTP server - that traffic is leaving your local network towards an Internet host. Either way you need to create Access Rules for that purpose allowing udp/123 port through. How you're going to do that? I think this is a matter of creating respective Rules in your Smart Dashboard and allow traffic as a principle.

In the mean time please do think about allowing that NTP sync to all "network devices" not only CP host (your FW). Local hosts like PC usually sync-ntp (time w32t) against their DC (domain controller) so no need to allow "hosts" to sync via Internet or locally to your NTP server. IT is now a matter ... can you deploy that yourself?  

hope it helps.

J.

[Erakul_Siddhart]

It's really helpful Jerry Thank You.

I will think and try this one how its getting sync with all the device over NTP server.

[PhoneBoy]

If you want to learn about how NTP works in general (not Check Point specific): ntp.org: Home of the Network Time Protocol 

Various features in the product rely on the security gateway having an accurate clock, specifically TLS, IPSEC, logging, state sync, and others.

[Erakul_Siddhart]

Sure Dameon, I will refer and learn that first and use it in Checkpoint.

Thank you so much...