Synchronize time on FTD devices

Use a Network Time Protocol (NTP) server to synchronize the clock settings on your devices. We recommend you configure all Firewall Threat Defenses managed by a Cloud-Delivered Firewall Management Center to use the same NTP server as the Cloud-Delivered Firewall Management Center. Depending on the platform and configuration, the Firewall Threat Defense synchronizes either directly with the configured NTP server or through Cloud-Delivered Firewall Management Center. If the Firewall Threat Defense's configured NTP servers are not reachable for any reason, it synchronizes its time with the Cloud-Delivered Firewall Management Center.

The device supports NTPv4.

Note

If you are deploying Firewall Threat Defense on the Firepower 4100/9300 chassis, you must configure NTP on the Firepower 4100/9300 chassis so that Smart Licensing will work properly and to ensure proper timestamps on device registrations. You should use the same NTP server for the Firepower 4100/9300 chassis and the Cloud-Delivered Firewall Management Center.

Before you begin

  • If your organization has one or more NTP servers that your Firewall Threat Defense can reach, use the same NTP server or servers for your devices that you have configured for Time Synchronization on the Administration > Configuration page on your Cloud-Delivered Firewall Management Center.

  • If you selected Use the authenticated NTP server only when configuring NTP server or servers for the Cloud-Delivered Firewall Management Center, for your devices use only the NTP server or servers that are configured to authenticate with the Cloud-Delivered Firewall Management Center. (The managed devices will use the same NTP servers as the Cloud-Delivered Firewall Management Center, but their NTP connections will not use authentication.)

  • If your device cannot reach an NTP server or your organization does not have one, use the Via NTP FROM Management Center option as discussed in this procedure.

Procedure

Step 1

Choose Devices > Platform Settings and create or edit the Firewall Threat Defense policy.

Step 2

Select Time Synchronization.

Step 3

Configure one of these clock options:

  • Via NTP FROM Management Center: (Default). The managed device gets time FROM the NTP servers you configured for the Cloud-Delivered Firewall Management Center (except for authenticated NTP servers) and synchronizes time with those servers directly. However, if any of these are true, the managed device synchronizes time FROM the Cloud-Delivered Firewall Management Center:

    • The Cloud-Delivered Firewall Management Center’s NTP servers are not reachable by the device.

    • The Cloud-Delivered Firewall Management Center has no unauthenticated servers.

    Note
    NTP synchronization behavior and NTP status output can differ between Firewall Threat Defense Virtual devices and Secure Firewall 3100 appliances when the devices are configured to synchronize time through Cloud-Delivered Firewall Management Center.

    • Firewall Threat Defense Virtual devices synchronize directly with the NTP servers configured on Cloud-Delivered Firewall Management Center. If the configured NTP servers become unreachable, the device uses Cloud-Delivered Firewall Management Center as the fallback NTP source.

    • Secure Firewall 3100 appliances synchronize with Cloud-Delivered Firewall Management Center instead of directly synchronizing with the external NTP servers configured on Cloud-Delivered Firewall Management Center. In NTP status output, Cloud-Delivered Firewall Management Center can appear as 127.0.0.2.

    • On Secure Firewall 3100 appliances, the ntpq -pn command can display 127.0.0.2 as the active NTP source, indicating synchronization with Cloud-Delivered Firewall Management Center rather than with external NTP servers.

    Example:

    # ntpq -pn
remote           refid      st t when poll reach   delay   offset   jitter
==============================================================================
127.0.0.2       .FMC.      16 u   10   64   377    0.123    0.045    0.010

    When you configure Secure Firewall 3100 appliances to synchronize directly with NTP servers instead of synchronizing through Cloud-Delivered Firewall Management Center, and the configured NTP servers become unreachable, the appliance falls back to its local system clock. In this case, the appliance does not use Cloud-Delivered Firewall Management Center as the fallback NTP source.

    Consider these platform-specific differences when interpreting show ntp and ntpq -pn output during NTP validation and troubleshooting.

  • Via NTP FROM: If your Cloud-Delivered Firewall Management Center is using NTP servers on the network, select this option and enter the fully-qualified DNS name (such as NTP.example.com), or IPv4 or IPv6 address, of the same NTP servers you specified in Administration > Configuration > Time Synchronization. If the NTP servers are not reachable, the Cloud-Delivered Firewall Management Center acts as an NTP server.

When multiple NTP servers are configured, the device uses the NTP server that is deemed appropriate based on the criteria defined in RFC. Thus, the status "Being used" for a specific NTP server indicates that the server is currently used by the device.

Step 4

Click Save.

After completing these steps, the Firewall Threat Defense Virtual device synchronizes its clock with the configured NTP server, Management Center, or the local system clock, depending on platform behavior and configuration.

What to do next

  • Deploy configuration changes.