NTP Best practices

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

NTP Best practices

L2 Linker

Hello,

I have a PA firewall without panorama, at present I have public ntp servers in sync with pool.ntp.org which are default from PA. Is this good to use public NTP server or local NTP server ? Please let me know the best practices on this.

2 REPLIES 2

Cyber Elite
Cyber Elite

@Rajesh-Networks,

The most important aspect of NTP for network endpoints and servers is that they're polling NTP from the same location. Whether that's a public NTP server like pool.ntp.org or an internal NTP server(s) that you have setup, you want everything to actually utilize the same source. Ask whoever is running your servers and desktop configuration where they've got NTP pointed towards, and try to make sure that you all utilize the same NTP servers.

 

I've personally always been fond of using internal NTP servers whenever possible instead of relying on an external source. The driving factor of that however is primarily simply that I'm not adding an unnecessary external access requirement for nodes across the network. I also don't allow our management network access to the internet, so things like switches wouldn't be able to poll from an external source. 

Cyber Elite
Cyber Elite

Hello,

As @BPry mentioned, it depends on your company policies, architecture, and compliance requirements. We try to limit what can go directly out to the internet for certain things. When it comes to NTP and DNS, we have our Domain Controllers reach out to  us.pool.ntp.org and DNS to a secure DNS provider. Then everything else internally gets its info, DNS and NTP from the domain controllers. Easier on figuring out traffic pattern and logging etc.

 

Just my thoughts.

  • 1624 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!