NTP Best practices

[Rajesh-Networks]

Hello,

I have a PA firewall without panorama, at present I have public ntp servers in sync with pool.ntp.org which are default from PA. Is this good to use public NTP server or local NTP server ? Please let me know the best practices on this.

[BPry]

@Rajesh-Networks,

The most important aspect of NTP for network endpoints and servers is that they're polling NTP from the same location. Whether that's a public NTP server like pool.ntp.org or an internal NTP server(s) that you have setup, you want everything to actually utilize the same source. Ask whoever is running your servers and desktop configuration where they've got NTP pointed towards, and try to make sure that you all utilize the same NTP servers.

I've personally always been fond of using internal NTP servers whenever possible instead of relying on an external source. The driving factor of that however is primarily simply that I'm not adding an unnecessary external access requirement for nodes across the network. I also don't allow our management network access to the internet, so things like switches wouldn't be able to poll from an external source. 

[OtakarKlier]

Hello,

As @BPry mentioned, it depends on your company policies, architecture, and compliance requirements. We try to limit what can go directly out to the internet for certain things. When it comes to NTP and DNS, we have our Domain Controllers reach out to  us.pool.ntp.org and DNS to a secure DNS provider. Then everything else internally gets its info, DNS and NTP from the domain controllers. Easier on figuring out traffic pattern and logging etc.

Just my thoughts.