This document describes the configuration, verification and troubleshoot of NTP on Firepower Appliances (FPR1xxx, FPR2100, FPR41xx, FPR9300).
Contributed by Anita Pietrzyk, Mikis Zafeiroudis, Cisco TAC Engineers.
There are no specific requirements for this document.
FPR4140 running FXOS 2.3(1.130) and 2.8(1.105)
FPR2110 running ASA platform mode
FPR1140 running ASA appliance mode
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.
On Firepower the NTP operation depends on the platform.
The ASA or FTD time is taken from the chassis Firepower Chassis Manager (FCM) Management Input/Output (MIO). MIO is the supervisor of the Firepower chassis.
NTP is used for time synchronization. NTP uses as a transport the UDP port number 123.
Supported NTP versions on FXOS:
FXOS 220.127.116.11 and later use NTP version 3
Older FXOSthan 18.104.22.168 use NTP version 2
Supported version changed due to CSCve58269 - NTP: change v2 to v3
Note: NTP version 4 is not officially supported. NTP version 4 is backwards compatible to NTP version 3.
NTP on FPR 41xx/9300
To configure NTP on a Firepower 41xx/9300 appliance log in to FCM and navigate to the Platform Settings tab.
The NTP on the logical devices (ASA or FTD) is synchronized with the MIO.
Currently there is no possibility to synchronize NTP on FTD with Firepower Management Center (FMC), even if you choose that option, NTP on FTD is synchronized with MIO. Thus, it is highly recommended that FMC and FCM use the same NTP server.
The FMC is not a full-blown NTP server. It can just provide time settings to its managed devices through the sftunnel. Thus, it cannot be used as the NTP server for the Firepower 41xx/9300 chassis.
Proper NTP configuration is required for a successful Smart License installation.
NTP on FPR 1xxx/2100
To configure NTP on a Firepower 1xxx/2100 appliance navigate to the Platform Settings tab from the FCM (Firepower Chassis Manager) (Firepower for ASA in Platform mode).
In case of an ASA in Platform mode the NTP on the logical device is synchronized with the MIO.
Configure the NTP settings on the logical application itself. The ASA in Appliance mode or in case of FTD on-box management from the Firepower Device Manager (FDM).
In case the FTD is managed by FMC (off-box management), configure the NTP on the FMC.
Note: On post-9.13(1) versions you can run the Firepower 1xxx/2100 for ASA in these modes: Appliance mode (the default) and Platform mode. Appliance mode allows you to configure all settings, including NTP, on the ASA. Only advanced troubleshoot commands are available from the FXOS CLI. On the other hand, in Platform mode you must configure basic settings (including NTP) and hardware interface settings in chassis manager (FCM).
Configure the NTP on FPR 1xxx/2100/41xx/9300 Appliances
Step1. Log in into the Firepower Chassis Manager GUI with the Local user credentials and navigate to Platform Settings > NTP. Select the Add button:
Step 2. Specify the NTP server IP address or hostname (If you use a hostname for the NTP server, you must configure a DNS server).
Note: You can configure up to 4 NTP Servers
Verify the NTP Synchronization on FPR41xx/9300 Appliances
Monitor the Server Status
Server Status reference
Not available: The default status shown immediately after the NTP server configuration.
Unreachable/Invalid: Shown in these scenarios:
When the NTP server IP address or host name is unreachable by the NTP protocol.
When the NTP server IP address or host name is reachable, but the remote host is not an NTP server.
Other internal failures such as when the query fails to execute, exception thrown, undefined time sync status is encountered, etc.
Synchronization in progress: The server is reachable and supports the NTP protocol, the initial time converge is still going on and has not completed yet.
Synchronized: The host is declared as the system sync peer and the time clock is in synchronization with it.
Candidate: The host is the candidate (standby) peer. A candidate NTP server means it is a valid one and has successfully communicated with the Firepower appliance, but the module has been synchronized with another NTP server so it is the standby one. It can be elected as the next in-sync peer if the current one is deleted.
Outlier: An NTP server that is discarded due to big difference (time offset and round-trip delay) compared to the rest of the NTP servers.
Verify the NTP Configuration on FPR41xx/9300 Appliances
Verify the NTP Synchronization Between MIO and Logical Device (Blade) on FPR41xx/9300 Appliances
On FPR41xx/9300 the NTP settings are pushed to FTD via the MIO (chassis). The NTP configuration from the FTD CLI or the FMC UI is not possible.
Each FTD blade uses an internal reference-id:22.214.171.124 to communicate with the MIO for time sync and based on that, it shows whether it is synchronized or not. The FTD CLI reflects this. Note that the NTP IP in this example is the internal ref-id, not the actual NTP Server IP. A change of the NTP server IP in the FCM does not affect this output since the reference-id is always the same:
> show ntpNTP Server : 203.0.113.126
Status : Being Used
Offset : -0.078 (milliseconds)
Last Update : 43 (seconds)
Verify the NTP Configuration on FPR1xxx/2100 Appliances
Caution: This is only applicable on FPR1xxx/2100 appliances for ASA in Platform mode.
firepower-2140# scope system
firepower-2140 /system # scope services
firepower-2140 /system/services # show ntp-server detail
NTP server hostname:
Time Sync Status: Time Synchronized
Time Sync Status: Candidate
Troubleshoot Common Issues
1. FXOS not Able to Resolve the NTP Server Hostname
The FCM UI shows:
Use the ping command to verify the NTP server hostname resolution