Synchronize with External NTP server.

Dear All Good morning,
Environment:
SunOS CSF-2 5.10 Generic_138888-03 sun4u sparc SUNW, Sun-Fire-V245 system.
Sun Cluster 3-2 Two node.
Question:
How to Synchronize Cluster timing with external NTP server/device? If external NTP device is down will have any impact in the cluster setup?

epmuneer wrote:
Question:
How to Synchronize Cluster timing with external NTP server/device?The configuration for NTP on Solaris Cluster is explained here:
[http://docs.sun.com/app/docs/doc/820-4676/cacbdgeg?l=en&a=view|http://docs.sun.com/app/docs/doc/820-4676/cacbdgeg?l=en&a=view]
and
[http://docs.sun.com/app/docs/doc/820-4677/cbhijhbh?l=en&a=view|http://docs.sun.com/app/docs/doc/820-4677/cbhijhbh?l=en&a=view]
If external NTP device is down will have any impact in the cluster setup?You should configure the cluster nodes as peers as well as getting the time from the external NTP server.
If the external NTP server fails, then time will drift, but at least the cluster nodes keep themselves in sync to have a consistent view.
Regards
Thorsten

Similar Messages

WLC Web-auth fail with external RADIUS server

I follow step by step the link bellow to configure web-auth with external RADIUS server but I receive a error on console debug of the WLC "Returning AAA Error No Server (-7) for mobile"
My Radius Server is fine, because I can authenticate on WLC Web page with RADIUS user.
WLC 4402 version 4.1.171.0
http://www.cisco.com/en/US/products/ps6366/prod_technical_reference09186a0080706f5f.html

Hi,
I am having some issues when I try to authenticate an AD account against a NAP Radius Server on Windows 2008.
In fact, I own a WLC 2106 and I configured it to authenticate users againts a radius Server with Active Directory. I set the Web Radius Authentication to CHAP on the controller tab from the WLC 2106 and i am getting the error below
: Authentication failed for gcasanova. When I set the controller to Web Radius Authentication to PAP, everything is working fine. I am able to connect to through the controller using an AD Account. But my purpose is not use PAP which is an unsecure protocol since password are sent as plaintext on the network.
Can someone tell me what's wrong?
*radiusTransportThread: Oct 26 11:02:13.975:    proxyState......................                                                                                                 .............00:24:D7:40:E5:00-00:00
*radiusTransportThread: Oct 26 11:02:13.975:    Packet contains 0 AVPs:
*emWeb: Oct 26 11:02:13.977: Authentication failed for gcasanova
*aaaQueueReader: Oct 26 11:02:29.985: AuthenticationRequest: 0xb6564634
*aaaQueueReader: Oct 26 11:02:29.985:   Callback.....................................0x8576720
*aaaQueueReader: Oct 26 11:02:29.985:   protocolType.................................0x00000001
*aaaQueueReader: Oct 26 11:02:29.985:   proxyState...................................00:24:D7:40:E5:00-00:00
*aaaQueueReader: Oct 26 11:02:29.986:   Packet contains 11 AVPs (not shown)
*aaaQueueReader: Oct 26 11:02:29.986: apfVapRadiusInfoGet: WLAN(4) dynamic int attributes srcAddr:0x0, gw:0x0, mask:0x0, vlan:0, dpPort:0, srcPort:0
*aaaQueueReader: Oct 26 11:02:29.986: 00:24:d7:40:e5:00 Successful transmission of Authentication Packet (id 86) to 10.2.0.15:1812, proxy state 00:24:d7:40:e5:00-00:00
*aaaQueueReader: Oct 26 11:02:29.987: 00000000: 01 56 00 9a 8e 48 e7 20 1d ef be 29 e6 3a 61 6d .V...H.....).:am
*aaaQueueReader: Oct 26 11:02:29.987: 00000010: 2b de 07 24 01 0b 67 63 61 73 61 6e 6f 76 61 3c +..$..gcasanova<
*aaaQueueReader: Oct 26 11:02:29.987: 00000020: 12 3c ce a0 87 ac df 7a a5 35 af 7c ef 83 c7 58 .<.....z.5.|...X
*aaaQueueReader: Oct 26 11:02:29.987: 00000030: ed 03 13 28 a7 5a 0d 26 6d ab 49 ea da 7c 5a 8e ...(.Z.&m.I..|Z.
*aaaQueueReader: Oct 26 11:02:29.987: 00000040: 1d 94 70 69 06 06 00 00 00 01 04 06 0a 02 00 06 ..pi............
*aaaQueueReader: Oct 26 11:02:29.987: 00000050: 05 06 00 00 00 01 20 0a 50 41 52 2d 57 4c 43 31 ........PAR-WLC1
*aaaQueueReader: Oct 26 11:02:29.987: 00000060: 3d 06 00 00 00 13 1a 0c 00 00 37 63 01 06 00 00 =.........7c....
*aaaQueueReader: Oct 26 11:02:29.988: 00000070: 00 04 1f 0c 31 30 2e 32 2e 30 2e 31 35 36 1e 0a ....10.2.0.156..
*aaaQueueReader: Oct 26 11:02:29.988: 00000080: 31 30 2e 32 2e 30 2e 36 50 12 7f 86 5a c5 61 ad 10.2.0.6P...Z.a.
*aaaQueueReader: Oct 26 11:02:29.988: 00000090: af 54 fa fa 42 e7 f6 16 9e 10                    .T..B.....
*radiusTransportThread: Oct 26 11:02:29.988: 00000000: 03 56 00 14 a9 10 07 84 83 00 87 83 b9 10 64 e1 .V............d.
*radiusTransportThread: Oct 26 11:02:29.988: 00000010: 66 b3 c5 5e                                       f..^
*radiusTransportThread: Oct 26 11:02:29.988: ****Enter processIncomingMessages: response code=3
*radiusTransportThread: Oct 26 11:02:29.988: ****Enter processRadiusResponse: response code=3
*radiusTransportThread: Oct 26 11:02:29.988: 00:24:d7:40:e5:00 Access-Reject received from RADIUS server 10.2.0.15 for mobile 00:24:d7:40:e5:00 receiveId = 0
*radiusTransportThread: Oct 26 11:02:29.989: 00:24:d7:40:e5:00 Returning AAA Error 'Authentication Failed' (-4) for mobile 00:24:d7:40:e5:00
*radiusTransportThread: Oct 26 11:02:29.989: AuthorizationResponse: 0xb97fe774
*radiusTransportThread: Oct 26 11:02:29.989:    structureSize................................32
*radiusTransportThread: Oct 26 11:02:29.989:    resultCode...................................-4
*radiusTransportThread: Oct 26 11:02:29.989:    protocolUsed.................................0xffffffff
*radiusTransportThread: Oct 26 11:02:29.989:    proxyState...................................00:24:D7:40:E5:00-00:00
*radiusTransportThread: Oct 26 11:02:29.989:    Packet contains 0 AVPs:

How to setup NTP service in server 2012 R2 to synch with an external NTP server

Server 2012 R2 Std as DC
I have looked at the blogs on setup and could not make sense of them. I did this easily on SBS2008 before I migrated to 2012 R2.
What is the process to establish the DC server 2012 R2 as the time source. Right now it is BIOS clock and I wish to move to NTP as the time source.
Thanks for your help
John Lenz

Hi JohnLenz,
You can use the following command line and refer the following KB:
w32tm /config /syncfromflags:manual
w32tm /config /manualpeerlist:<IP_or_FQDN_of_the_time_source>
Note: please replace "<IP_or_FQDN_of_the_time_source>” with the IP address or FQDN of your NTP server.
Net stop w32time
Net start w32time
The related KB:
Synchronize the Time Server for the Domain Controller with an External Source
http://technet.microsoft.com/en-us/library/cc784553(v=ws.10).aspx
Configure the Time Source for the Forest
http://technet.microsoft.com/zh-cn/library/cc794937(v=ws.10).aspx
Configuring a time source for the forest
http://technet.microsoft.com/en-us/library/cc784800(v=ws.10).aspx
I’m glad to be of help to you!
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Authentication Policy ISE with External RADIUS Server

Hi All,
I would like to authenticate client by using External RADIUS. Once I create authentication policy using the new compound condition (wireless dot1x + Radius Username Matches "domainB\") I would like to forward the user authentication who make an authen using domainB\username to the External RADIUS Server Sequence. But when I check on the authentication dashboard, it still authenticate using the default authentication rule.
Please suggest about this scenario.
Regards,
Sent from Cisco Technical Support Android App

Hi jrabinow,
Which details you would like to see ?
Here is some infos.
ISEs are deployed in 2 domains such as "acme.com" and "sub.acme.com"
Each domain does not make a trusted relationship so these 2 domains cannot communicate between them.
Each domain has owned Enterprise Root CA (Microsoft)
Client who need to access the network need to authenticate with EAP-TLS.
My environment
My ISE node joined into domain "acme.com"
User will be "[email protected]"
Once the user from "[email protected]" try to authenticate, I would like to forward the RADIUS request from ISEs (acme.com) to other ISEs (sub.acme.com)
After ISEs in "sub.acme.com" return RADIUS-ACCEPT then ISEs in "acme.com" will process an authorization policy.
Regards,
Pongsatorn

Configuring Cisco ISE for Authorization with External Radius Server attribute

Hi,
I'm trying to integrate an external radius server with Cisco ISE.
I created an External Identity Store>Radius Token Server.
I created a Identity Store sequence with just one identity store just as creadted above.
And I was able to authenticate successfully.
But when it comes to authorization.
I observed we just have one tab named Authorization while creating Radius Token server.
And it always refers to ACS:attribute_name.
If I want to define a IETF radius attribute, (lets say class with attribute id as 25), how could I do it.
In Cisco ACS we have a direct entry option in authorization tab where we can define the radius (IETF) attribute within Radius token server creation (within radius token server>Directory attribute tab).
How ever I try to define the IETF attribute here (class,IETF:Class) I am not able to authorize with this attribute value.
I tried with just one single authorization rule where it could hit.But observed it to go the default(as none of the rules defined matches the condition).
Can anyone guide me how can we define a IETF radius attribute for authorization within Cisco ISE and what policy could we set it to work as authorization.
Thanks in advance
Senthil K

This is the step of Creating and Editing RADIUS Vendors
To create and edit a RADIUS vendor, complete the following steps:
Step 1 From the Administration mega menu, choose Resources > RADIUS Vendors.
The RADIUS Vendors page appears with a list of RADIUS vendors that ISE supports.
Step 2 Click Create to create a new RADIUS vendor or click the radio button next to the RADIUS vendor that
you want to edit and click Edit.
Step 3 Enter the following information:
• Name—(Required) Name of the RADIUS vendor.
• Description—An optional description for the vendor.
• Vendor ID—(Required) The Internet Assigned Numbers Authority (IANA)-approved ID for the
vendor.
• Vendor Attribute Type Field Length—(Required) The number of bytes taken from the attribute value
to be used to specify the attribute type. Valid values are 1, 2, and 4. The default value is 1.
• Vendor Attribute Size Field Length—(Required) The number of bytes taken from the attribute value
to be used to specify the attribute length. Valid values are 0 and 1. The default value is 1.
Step 4 Click Submit to save the RADIUS vendor.

Using zen preboot with external pxe-server

Hello,
I have the same thread in the ZCM11-Forum, but with ten it seems some people have found a solution. So, can you please look at this thread if you know how to boot the ZCM via an external PXE-Server.
http://forums.novell.com/novell/nove...xe-server.html
Regards

mrjohndoe,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Visit http://support.novell.com and search the knowledgebase and/or check all
the other self support options and support programs available.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://forums.novell.com)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://forums.novell.com/faq.php
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://forums.novell.com/

How to setup OID to synchronize with 2nd AD server

Hi there,
We are currently using OAS 10g (10.1.2.0.2)
We have configured OID to synchronize 1 way with 1 AD domain server on Global catalog port.
Now I have a 2nd AD domain server which we need to pull in the user accounts and synchronize any changes to these accounts into the same OID.
I have created a new integration profile in ODM to synchronzie accounts from 2nd domain server.
I have successfully pulled in the AD user accounts from the 2nd AD domain into OID by bootstrapping using the properties file method(only this method works, the usual bootstrap command without properties file doesnt work at all).
But after pulling in the AD accounts from 2nd domain server, the synchronization profile for the 2nd AD domain doesnt synchronize any changes in user account nor any new user created at 2nd domain end.
Have checked the synchronization profile trace file but could not find any thing wrong.
The new integration profile which was created for the 2nd AD domain is using the same "Connected Direcotory URL" as all the other profiles that we have for the 1st AD domain.
Can someone advise what is wrong with my OID synchronization process for the 2nd AD domain?
Any help to point me in the right direction would be appreciated.
(running out of time!).
Cheers
Jim

Thanks for your relpy.
Do I require a separate AD admin account on the 2nd AD server in order to perform the ldapbind? or can I use the same AD admin account from the 1st AD server which I'm currently using on OID to sync with the 1st AD server?
Cheers
Peng Soon

ICal Server email invitations with external mail server

So I see lots of people have worked out the kinks to get iCal Server to send invites to external email accounts when using the Mail server on the same machine as the iCal Server, but who has it working when the mail server is somewhere else? Any help would be appreciated... I have setup it up like this:
Email Address: [email protected]
Incoming Mail Server: mail.mailserver.com
User Name: com.apple.calendarserver (I created this account on the mail server)
Password: Same as the one in my keychain for com.apple.calendarserver
Outgoing Mail Server: mail.xyz.com
Username: com.apple.calendarserver
Password: Same as the one in my keychain for com.apple.calendarserver
When I send invites, this is what I get in the logs:
2010-05-24 20:59:31-0500 [-] [caldav_task] 2010-05-24 20:59:31-0500 [-] [calendarserver.sidecar.task#debug] Checking for tasks
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] RECEIVED: * OK mail.mailserver.com Zimbra IMAP4rev1 service ready
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] IMAP servergreeting
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] SENDING: 0001 CAPABILITY
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] RECEIVED: * CAPABILITY IMAP4rev1 AUTH=PLAIN AUTH=X-ZIMBRA ACL BINARY CATENATE CHILDREN CONDSTORE ENABLE ESEARCH ID IDLE LIST-EXTENDED LITERAL+ LOGIN-REFERRALS MULTIAPPEND NAMESPACE QRESYNC QUOTA RIGHTS=ektx SASL-IR SEARCHRES UIDPLUS UNSELECT WITHIN
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] RECEIVED: 0001 OK CAPABILITY completed
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] SENDING: 0002 AUTHENTICATE PLAIN
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] RECEIVED: +
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] SENDING: AGNvbS5hcHBsZS5jYWxlbmRhcnNlcnZlcgB5M1h4bkZaejU3ZEZVVExW
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] RECEIVED: 0002 OK [CAPABILITY IMAP4rev1 ACL BINARY CATENATE CHILDREN CONDSTORE ENABLE ESEARCH ID IDLE LIST-EXTENDED LITERAL+ LOGIN-REFERRALS MULTIAPPEND NAMESPACE QRESYNC QUOTA RIGHTS=ektx SASL-IR SEARCHRES UIDPLUS UNSELECT WITHIN] AUTHENTICATE completed
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] IMAP logged in [unauth]
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] SENDING: 0003 SELECT Inbox
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] RECEIVED: * 0 EXISTS
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] RECEIVED: * 0 RECENT
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] RECEIVED: * OK [UIDVALIDITY 1] UIDs are valid for this mailbox
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] RECEIVED: * OK [UIDNEXT 258] next expected UID is 258
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] RECEIVED: * FLAGS (\Answered \Deleted \Draft \Flagged \Seen $Forwarded $MDNSent Forwarded $Junk $NotJunk Junk JunkRecorded NonJunk NotJunk)
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] RECEIVED: * OK [PERMANENTFLAGS (\Answered \Deleted \Draft \Flagged \Seen $Forwarded $MDNSent Forwarded \*)] junk-related flags are not permanent
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] RECEIVED: * OK [HIGHESTMODSEQ 12] modseq tracked on this mailbox
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] RECEIVED: 0003 OK [READ-WRITE] SELECT completed
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] IMAP Inbox selected [unauth]
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] Unhandled unsolicited response: ['OK', ['HIGHESTMODSEQ', '12'], 'modseq', 'tracked', 'on', 'this', 'mailbox']
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] SENDING: 0004 UID FETCH 1:* (UID)
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] RECEIVED: 0004 OK UID FETCH completed
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] IMAP got uids [unauth]
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] IMAP Inbox has 0 messages
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] SENDING: 0005 CLOSE
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] RECEIVED: 0005 OK CLOSE completed
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] IMAP in cbClosed [unauth]
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] Mailbox closed
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] SENDING: 0006 LOGOUT
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] RECEIVED: * BYE mail.mailserver.com IMAP4rev1 server terminating connection
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadProtocol#debug] RECEIVED: 0006 OK LOGOUT completed
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadFactory#debug] IMAP factory connection lost
2010-05-24 20:59:39-0500 [-] [mailgateway] 2010-05-24 20:59:39-0500 [IMAP4DownloadProtocol,client] [twistedcaldav.mail.IMAP4DownloadFactory#debug] Scheduling next IMAP4 poll
Any help would be greatly appreciated!

Okay, got this figured out. Appears that the email server my client's company uses is terminating the connection when the Xserve tries to do anything. I setup a test Gmail account and used those settings instead and everything worked just fine.

How to synchronize with internet time server automatically?

Our 2008 R2's clock gets 1 or 2 minutes ahead every week. We have to go to the Internet Time Settings dialog box to click "Update now" to do the sync and it always works. Is there any trick to get the automatic synchronization work?
What is the sync schedule? It can't be once per month, can it?
Hong

Try this:
w32tm /config /manualpeerlist:TimeServerFQDNorIPAddress,0x8 /syncfromflags:MANUAL /reliable:yes
w32tm /config /update
net stop w32time
net start w32time
w32tm /resync
Regards,
Rafic
If you found this post helpful, please give it a "Helpful" vote.
If it answered your question, remember to mark it as an "Answer".
This posting is provided "AS IS" with no warranties and confers no rights! Always test ANY suggestion in a test environment before implementing!

ASA5500 using Windows 7 computer as NTP server

I have an ASA5510 connected to a computer running Windows 7 (the NTP Server) on its "inside" interface.
Using the ASDM, I have configured the ASA5510 to use the Windows 7 as its NTP server (my architecture forces me to use a local machine as an NTP server):
     -IP address: 192.0.99.1 (the ASA5510 has an IP address of 192.0.99.40)
     -Interface: inside
     -Key number: None
     -Enable NTP authentication: no.
I have other Windows computers on the "inside" interface using the NTP Server, so NTP traffic is relayed without any problem. But somehow, the ASA5510 is not able to synchronize with the NTP Server.
I see the following log entry:
     -Source IP: 192.0.99.1
     -Source Port: 123
     -Destination IP: 192.0.99.40
     -Destination port: 65535
     -Description: Teardown UDP connection 3905 for inside: 192.0.99.1/123 to identity: 192.0.99.40/65535 duration 0:02:01 bytes 96
so it seems like the ASA5510 sends a request to the NTP Server, but I am not sure whether the reply doesn't get processed correctly, or the connection stays open too long (my UDP connection timeout is the default, 2 minutes).
I had trouble getting SonicWALL NSA2400s to use Windows 7 devices as NTP servers. I had to get a firmware version where there was no MD5 authentication (which I think is OK in this case), and change a setting in the Windows registry (HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/services/W32Time/Config/AnnounceFlags: from 0xa to 0x5)
any insight is welcome.
Pedro

I have turned on all ntp debugging, and run "show ntp status" and "show ntp assoc":
CCG-SHIP-FWL(config)# show debug
debug ntp adjust enabled at level 1
debug ntp authentication enabled at level 1
debug ntp events enabled at level 1
debug ntp packets enabled at level 1
debug ntp params enabled at level 1
debug ntp select enabled at level 1
debug ntp sync enabled at level 1
debug ntp validity enabled at level 1
CCG-SHIP-FWL(config)# show ntp status
Clock is unsynchronized, stratum 16, no reference clock
nominal freq is 99.9984 Hz, actual freq is 99.9984 Hz, precision is 2**6
reference time is 00000000.00000000 (06:28:16.000 GMT Thu Feb 7 2036)
clock offset is 0.0000 msec, root delay is 0.00 msec
root dispersion is 0.00 msec, peer dispersion is 0.00 msec
CCG-SHIP-FWL(config)# show ntp assoc
      address         ref clock     st when poll reach delay offset    disp
~192.16.99.1      .LOCL.            1   380 1024 337    73.0 255671    71.0
* master (synced), # master (unsynced), + selected, - candidate, ~ configured
CCG-SHIP-FWL(config)# NTP: xmit packet to 192.16.99.1:
leap 3, mode 3, version 3, stratum 0, ppoll 1024
rtdel 0000 (0.000), rtdsp 10400 (1015.625), refid 00000000 (0.0.0.0)
ref 00000000.00000000 (06:28:16.000 GMT Thu Feb 7 2036)
org d34ac42f.4609d99d (20:21:03.273 GMT Tue May 1 2012)
rec d34a6050.3598360c (13:14:56.209 GMT Tue May 1 2012)
xmt d34a6250.22e73ba2 (13:23:28.136 GMT Tue May 1 2012)
NTP: rcv packet from 192.16.99.1 to OWN_FWL_LAN_PORT on inside:
leap 0, mode 4, version 3, stratum 1, ppoll 1024
rtdel 0000 (0.000), rtdsp a0bf4 (10046.692), refid 4c4f434c (76.79.67.76)
ref d34abbb0.bb426e39 (19:44:48.731 GMT Tue May 1 2012)
org d34a6250.22e73ba2 (13:23:28.136 GMT Tue May 1 2012)
rec d34ac62f.3977adb6 (20:29:35.224 GMT Tue May 1 2012)
xmt d34ac62f.3977adb6 (20:29:35.224 GMT Tue May 1 2012)
inp d34a6250.233258a0 (13:23:28.137 GMT Tue May 1 2012)
NTP: nlist 0, allow 0, found 0, low 0.000000, high 0.000000
NTP: no select intersection
NTP: synchronization lost

Please help troubleshoot why SM-SRE WAAS module can't time sync with NTP server

I have a remote WAAS site where a SM-SRE-900 module is plugged in a 2945 router. Everything is fine except the module can't sync its time to the NTP server. Its NTP was configured right and it can reach the NTP server with no problem. There's no authentication configured. But somehow it can't associate with the NTP server. I have tried manual NTP sync, but it failed too.
The same NTP server and config is also used for many other WAAS site and the CM. They are all fine. I'm running WAAS 4.2.3 build 7. The module isn't showing any other alarms.
Here is some show outputs and the manual NTP sync result. I noticed its poll is only 64 seconds while all other sites are showing 1024 seconds.
waas1#sh ntp status
ntp enabled
ntp authentication disabled
server list:
Server           Key
10.0.0.1         -
     remote           refid      st t when poll reach   delay   offset jitter
==============================================================================
10.0.0.1        66.96.98.9       3 u   43   64 377   16.828 2359370 2421.24
waas1#ntp 10.0.0.1
16 Dec 22:06:20 ntpdate[9835]: bind() fails: Permission denied
Failed to set software clock using NTP server 10.0.0.1

What the SRE-900 have as it's time? Use the show clock command. Does it match within a few minutes of ntp already, if not, and if this is not the first first clock set out of the box, then ntp sync might fail.
You might try to manually set the clock correctly (set clock ... something), then see if the ntp server will sync.

How to configure time synchronization for two NTP servers

We have IOSXR 4.2.1 on routers CRS3 and ASR9K with all recomended SMUs; we need to configure the time synchronization for two NTP servers with the configuration below, but the routers became unstable; synchronize with one NTP servers for some time, then switch to other NTP server, and keep doing this. Anyone know why this behavior?
ntp
authentication-key 1 md5 encrypted 01070F074F0A05
authenticate
trusted-key 1
server 10.192.32.32 prefer
server 10.192.32.33
source Loopback50
update-calendar
RP/0/RP0/CPU0:DFCRSDTC1#sh log | i ntp
Wed Jul 10 09:37:04.621 BRSPO
RP/0/RP0/CPU0:Jul 4 21:29:18 : ntpd[256]: %IP-IP_NTP-5-SYNC_LOSS : Synchronization lost : 10.192.32.32 : Peer unreachable or clock selection failed
RP/0/RP0/CPU0:Jul 4 21:29:18 : ntpd[256]: %IP-IP_NTP-5-HP_CONN_LOST : High priority NTP peer connection lost - Stratum 2->15.
RP/0/RP0/CPU0:Jul 4 21:29:18 : ntpd[256]: %IP-IP_NTP-5-ALL_CONN_LOST : All NTP peer connections failed.
RP/0/RP0/CPU0:Jul 4 21:29:27 : ntpd[256]: %IP-IP_NTP-5-HP_CONN_RECOVERED : High priority NTP peer connection recovered - Stratum 15->2.
RP/0/RP0/CPU0:Jul 4 21:30:21 : ntpd[256]: %IP-IP_NTP-5-SYNC_LOSS : Synchronization lost : 10.192.32.32 : Peer unreachable or clock selection failed
RP/0/RP0/CPU0:Jul 4 21:30:21 : ntpd[256]: %IP-IP_NTP-5-HP_CONN_LOST : High priority NTP peer connection lost - Stratum 2->15.
RP/0/RP0/CPU0:Jul 4 21:30:21 : ntpd[256]: %IP-IP_NTP-5-ALL_CONN_LOST : All NTP peer connections failed.
RP/0/RP0/CPU0:Jul 4 21:31:36 : ntpd[256]: %IP-IP_NTP-5-HP_CONN_RECOVERED : High priority NTP peer connection recovered - Stratum 15->2.
RP/0/RP0/CPU0:Jul 4 21:35:56 : ntpd[256]: %IP-IP_NTP-5-SYNC_LOSS : Synchronization lost : 10.192.32.33 : Peer unreachable or clock selection failed
RP/0/RP0/CPU0:Jul 4 21:35:56 : ntpd[256]: %IP-IP_NTP-5-HP_CONN_LOST : High priority NTP peer connection lost - Stratum 2->15.
RP/0/RP0/CPU0:Jul 4 21:35:56 : ntpd[256]: %IP-IP_NTP-5-ALL_CONN_LOST : All NTP peer connections failed.
RP/0/RP0/CPU0:Jul 4 21:40:11 : ntpd[256]: %IP-IP_NTP-5-HP_CONN_RECOVERED : High priority NTP peer connection recovered - Stratum 15->2.
RP/0/RP0/CPU0:Jul 4 21:50:52 : ntpd[256]: %IP-IP_NTP-5-SYNC_LOSS : Synchronization lost : 10.192.32.33 : System clock selection failed
RP/0/RP0/CPU0:Jul 4 21:50:52 : ntpd[256]: %IP-IP_NTP-5-HP_CONN_LOST : High priority NTP peer connection lost - Stratum 2->6.
RP/0/RP0/CPU0:Jul 4 21:59:26 : ntpd[256]: %IP-IP_NTP-5-HP_CONN_RECOVERED : High priority NTP peer connection recovered - Stratum 6->2.
RP/0/RP0/CPU0:Jul 4 22:25:07 : ntpd[256]: %IP-IP_NTP-5-SYNC_LOSS : Synchronization lost : 10.192.32.33 : System clock selection failed
RP/0/RP0/CPU0:Jul 4 22:25:07 : ntpd[256]: %IP-IP_NTP-5-HP_CONN_LOST : High priority NTP peer connection lost - Stratum 2->6.
RP/0/RP0/CPU0:Jul 4 22:56:16 : ntpd[256]: %IP-IP_NTP-5-SYNC_LOSS : Synchronization lost : 10.192.32.33 : Peer unreachable or clock selection failed
RP/0/RP0/CPU0:Jul 4 22:56:16 : ntpd[256]: %IP-IP_NTP-5-ALL_CONN_LOST : All NTP peer connections failed.

Hi Claudio, that ddts is pretty generic to be honest but yes it is filed to address sync issues in the XR NTP algo.
The thing is that XR ntp clock selection is a bit different then iOS and follows the specs very closely which results in this erroneous loss behavior.
For instance, you could also see this issue with a sync loss if the update time is only 500msec off what it was before and that will result in a ntp sync loss rather then adjusting to it.
Also I wanted to mention that the ntp prefer is a bit of a misnomer in XR (since it follows the specs differently then IOS) and this knob was taken over from IOS really.
You might get some joy if you set it to one server only and see if that helps?
regards
xander

"Local" failover for NTP Server on Solaris 10

I have four Solaris 10 Servers, all syncing their time from an external NTP server ntp.example.com.
Is it possible to configure one of the four servers as a local "pseudo" Failover NTP, i.e. acting as a client to ntp.example.com, as long as it is available, and acting as a NTP server to the remaining three servers in case ntp.example.com is not available, so that at least the four local servers remain synced among themselves?

Shouldn't be any problem. For one thing you can always specify multiple servers in the /etc/inet/ntp.conf file and use one of them as 'prefer', i.e.:
server ntp.example.com prefer
server local.mydomain.com
Then again, perhaps it would just be easier if one of your servers syncs against 'ntp.example.com' and the rest of your servers always synchronizes against that one server?
.7/M.

W32tm always on "Local CMOS clock" on virtual domain controller - cannot change to NTP server

The domain controller (Server 2012R2) is hosted on Hyper-V (Server 2012R2). It is a PDC.
- firewall disabled
- cleaned up w32tm:
net stop w32time
w32tm /unregister
w32tm /register
net start w32time
- applied ifixit from http://support.microsoft.com/kb/816042 to enable external ntp server de.pool.ntp.org
- disabled
VMICTimeProvider in registry
(HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\VMICTimeProvider\Enabled = 0)
I can manually query the ntp server de.pool.ntp.org:
w32tm /stripchart /computer:de.pool.ntp.org /samples:5 /dataonly
de.pool.ntp.org wird verfolgt [131.188.3.221:123].
5 Proben werden gesammelt.
Es ist 24.04.2014 10:07:36.
10:07:36, +00.0115379s
10:07:38, -00.0025048s
10:07:40, -00.0008595s
10:07:42, -00.0010477s
10:07:44, -00.0014516s
But still, w32tm does NOT query the ntp server:
PS C:\Windows\system32> w32tm /query /source
Local CMOS clock
rosch

Hi rosch,
Based on your description, please check if disable the "Time synchronization" Integration service. Please refer
to the following operation.
In Hyper-V Manager, right click the DC and select “Settings…”.
In the left panel of Settings, navigate to Integration Services and click it.
Then in the right panel, please uncheck Time synchronization.
By the way, please check if can connect to the time server and UDP port was opened for NTP.
If any update, please feel free to let me know.
Hope this helps.
Best regards,
Justin Gu

Ntp server connection

Hello,
have a problem connecting to the ntp server please see below:
dslrouter#show ntp associations
address ref clock st when poll reach delay offset disp
~130.88.203.12 0.0.0.0 16 - 64 0 0.0 0.00 16000.
* master (synced), # master (unsynced), + selected, - candidate, ~ configured
dslrouter#show ntp status
Clock is unsynchronized, stratum 16, no reference clock
nominal freq is 250.0000 Hz, actual freq is 250.0000 Hz, precision is 2**16
reference time is 00000000.00000000 (00:00:00.000 UTC Mon Jan 1 1900)
clock offset is 0.0000 msec, root delay is 0.00 msec
root dispersion is 0.00 msec, peer dispersion is 0.00 msec
any reasons as this is the first time I am trying to synch to an NTP server.
on the wan inbound I have permitted the destination udp 123 port through the access-list

Do you have any ACL input in Gateway...disable one moment for test...it could be a problem from your ISP or ISP filter/Firewall input/output?? Could you try with another NTP server...

Synchronize with External NTP server.

Similar Messages

Maybe you are looking for