Sunday, December 15, 2013

NetScreen Snooping

1- Increase the size of the dbuf buffer from the default of 32k

set dbuf size 4096

2- By default, snoop will only capture the headers of packets, i.e. 96 bytes. It won't capture the entire packet. If you want to capture the entire packet, you will need to use snoop detail len, where len specifies the amount of data in bytes you wish to capture for each packet, e.g., snoop detail len 256 to capture the first 256 bytes of packets

snoop detail len 256

3- To create a filter so that you see only the pertinent data, unless you want to see everything.
snoop filter ip 10.10.10.10

4- Before starting snoop, make sure that the buffer is empty:

clear dbuf

5- Start snooping:

snoop

6- Make sure to close snoop, as it's resource intensive:

snoop off

7- You can send the captured data to an external tftp server:

get dbuf stream > tftp 10.10.10.11 capture.pcap

Reference: http://support.moonpoint.com/security/firewalls/netscreen/snoop.php 

Tuesday, October 1, 2013

How to disable SSL v2 on IIS 7.0/7.5 on Windows 2008

SSL v2 is weak and outdated protocol. All modern browsers support SSL v3 and it's enabled by default on Windows 2008 (IIS 7 / IIS 7.5). To make sure all clients are using SSL v3 we must disable SSL v2.

This is what needs to be done to disable SSL v2:

1. Start - Run
2. Type "regedit" and click OK
3. Locate the following key: HKey_Local_Machine\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0
4. Right click the "SSL 2.0" key and select Edit > Add key
5. Type "Server" and click Enter
6. Right click Server and select New > Add DWORD (32 bit) value
7. Type "Enabled" as the name and make sure the value is "0"
8. Restart the server

You can test your web server if it still supports SSL v2 or not using http://www.serversniff.net/content.php?do=ssl or http://foundeo.com/products/iis-weak-ssl-ciphers/

Reference: http://www.aip.im/2012/03/how-to-disable-ssl-v2-enable-ssl-v3-on-windows-2008/

Sunday, September 22, 2013

Schedule Task for NPS Config Backup [Server 2008]

On Windows Server 2008

1- Create a text file and modify extension to PS1
C:\Config_Backup_Script\nps_radius_config_bk.PS1
2- Enter the powershell command in the
netsh nps export filename="C:\NPS Configration Backup\nps_config_$(get-date -f yyyy-MM-dd).xml" exportPSK=YES
3- Open Task Scheduler, "Create Basic Task", follow the wizard.
4- Under the action, choose "Start program" and enter
powershell.exe "&'C:\Config_Backup_Script\nps_radius_config_bk.PS1'"
5- Right click the task and open properties.
  • "Change User or Group", choose "administrator" or any privileged user.
  • Tick "Run whether user is logged on or not".
  • Tick "Run with highest privileges".
  • Click Ok and provide the administrator password.
Enjoy

Monday, August 19, 2013

Nagios Log File Time Conversion [Human Readable]

To tail the file online:
tail -f /var/log/nagios3/nagios.log | perl -pe 's/(\d+)/localtime($1)/e'
To convert certain time stamp:
echo 1376930831 | perl -pe 's/(\d+)/localtime($1)/e'
Mon Aug 19 19:47:11 2013

Ubuntu APT Proxy Settings

Open apt configuration file
vim /etc/apt/apt.conf
and add the following:
Acquire::http::Proxy "http://username:password@proxyhostname:port";
The syntax shown above should be strictly followed.

This configuration may fail if your username or password has an '@' in it. You can also add proxy configuration for other protocols such as FTP. 

Wednesday, October 31, 2012

Installing Active Directory Users and Computers for Windows 2008


From server manager, go to Features, then add
Expand:
  • Remote Server Administration Tools
  • Role Administration Tools
  • Active Directory Domain Services Tools
and then check Active Directory Domain Controller Tools
it includes:
  • Active Directory Users and Computers
  • Active Directory Domains and Trusts
  • Active Directory Sites and Services
  • ...
Server 2008 R2 Instructions:
Under Role Administration Tools, expand
  • AD DS and AD LDS Tools
    • AD DS Tools
      • AD DS Snap-Ins and Command-Line Tools.

Tuesday, September 18, 2012

Creating Root Certificate Authority using Debian to implement PEAP authentication on Microsoft NPS Radius


############# Creating Root Certificate Authority over Debian #############

By default - CA.pl (and CA.sh for that matter) together with openssl.cnf are set up so that everything happens in the local directory - with the CA store in ./demoCA. This isn't so very useful. So - let's make some decisions.

Our CA certificate will have a life of 10 years
Our SSL certificates will have a life of 2 years
We will store the CA information in /etc/ssl/ca (alongside the other ssl files).

#############  Changes to CA.pl
Locate the variables at the top - DAYS and CADAYS. Change these lines to look like:

    $DAYS="-days 730";     # 2 year
    $CADAYS="-days 3650";  # 10 years
$CATOP="/etc/ssl/ca";

############# Changes to openssl.cnf
The first change must match the $CATOP variable from CA.pl - we need to change the dir variable so that it looks like

dir = /etc/ssl/ca

We should also set the default number of days to match $DAYS:

default_days = 730

Generating the CA certificate and storage area
cd testCA/
 /usr/lib/ssl/misc/CA.pl -newca

HINT: Your new cacert.pem file is now in /etc/ssl/ca/cacert.pem and can be distributed for installation in browsers etc.

############# Generating a certificate request
To create any server certificate for any reason, like PEAP or WEB servers

/usr/lib/ssl/misc/CA.pl -newreq

HINT:  The vital point is that the CN of the certificate must be the domain name of the site you wish to secure. You can use *.example.com for a wildcard certificate
HINT: This will generate a newkey.pem and a newreq.pem. newkey.pem you need to keep for later - newreq.pem you would send off for signing - in this case to yourself - but you could also use it for purchasing a real certificate.

############# Signing a certificate request
Given a newreq.pem in the current working directory run
/usr/lib/ssl/misc/CA.pl -sign

HINT: This will sign the request and generate a newcert.pem with the signed certificate. You will have to enter the password for your CA key which you supplied when creating the CA key, certificate and store.
HINT: It's better to rename those files to something useful:

mv newcert.pem NPS_RADIUS_04.cert
mv newkey.pem NPS_RADIUS_04.key

############# Removing passphrase
Note - your certicate's key has a passphrase assigned during the -newreq phase. If you want your software to autostart this won't work - since it prompts for the password. To remove a passphrase:
openssl rsa -in NPS_RADIUS_04.key -out NPS_RADIUS_04.nopass.key

############# Installing the issued certificate in Windows 2008
openssl pkcs12 -export -out cert+key.nopass.p12 -in NPS_RADIUS_04.cert -inkey NPS_RADIUS_04.nopass.key

should convert the cert and key into a PKCS#12 file, which Windows will probably have an easier time dealing with.


References:
http://www.debian-administration.org/articles/618

Wednesday, September 12, 2012

Wednesday, August 29, 2012

Running Windows 8 on ESXi 5.0


After failure to install Windows 8 on ESXi 4.1 and 5.0, finally I installed it following the virtuallyGhetto article
http://www.virtuallyghetto.com/2012/02/how-to-run-windows-8-consumer-preview.html

and through the article, the patch ESXi500-201112001 should be installed on ESXi 5.0.

and this is how to install it via command line after putting the host in maintenance mode:

esxcli software vib install --depot=/vmfs/volumes/datastore1/ESXi500-201112001.zip

While you can download ESXi500-201112001.zip from http://www.vmware.com/patchmgr/download.portal

Tuesday, August 28, 2012

Create Your Own Custom ESXi Image Using ESXi Customizer

ESXi 5.0 and the missing Intel 82579 was an issue with me installing ESXi 5.0 on Lenovo ThinkCenter M Series, but I manage to solve the issue by customizing the ESXi 5.0 after following the guide show in the following link

http://www.yoyoclouds.com/2012/08/create-your-own-custom-esxi-image-using.html


Hint: That Intel 82579 also exists in Dell OptiPlex 790 and 990 as well.

Wednesday, August 22, 2012

Connect to openvpn past enterprise firewall


The proper way is to do this :

  1. Setup openvpn to use tcp instead of udp on any port (1194 is default)
  2. Setup port forwarding to forward external 443 port to internal 1194 port.
  3. If the web browser on client side is using a proxy setup the openvpn client to use the proxy server for connection.
  4. Setup client to use tcp and port 443.

Then connect.

Reference: http://superuser.com/questions/303198/connect-to-openvpn-past-enterprise-firewall

USB support for ESX/ESXi 4.1 and ESXi 5.0


ESX/ESXi 4.1 and ESXi 5.0 supports USB device passthrough from an ESX or ESXi to a virtual machine.
 
This article provides information on:
  • USB device passthrough requirements and limitations
  • How to add a USB controller and a USB device.

Monday, February 27, 2012

Thick-provisioned disk to thin, in ESX 4.1


On ESXi 4.1 Copying virtual machines machines using Veeam FastSCP (Free version), if the copied machine disk was thin-provisioned, the pasted machine will be thick, so one solution is use the following command

vmkfstools –i <srcDisk> -d thin <dstDisk>

but don't forget to edit the <dstDisk> to indicate <dstDisk-flat>

Monday, February 20, 2012

Recreating a missing virtual machine disk (VMDK) descriptor file


Powering on the virtual machine fails with the error: The file specified is not a virtual disk (15) or Recreating a missing virtual machine disk (VMDK) descriptor file follow links below from the VMware knowledge base

http://kb.vmware.com/kb/1002511
http://kb.vmware.com/kb/1016838

While following the steps, you may find the scsi controller is "lsisas1068" which is not supported as virtual controller in the command vmkfstools, so you can use "lsilogic" instead like I did with my Windows 2008 and it worked just fine.

HINT:
scsi0.virtualDev = "lsisas1068"
This new controller is only available with virtual hardware 7
it is a good choice for Windows 7 and 2008 R2

Windows Server 2008: Allow multiple Remote Desktop sessions per user


Remote Desktop/Terminal Services has two settings for multiple sessions. You can either allow multiple sessions per user (in which case if you log in twice, you'll get two sessions), or force a single session per user (in which case you can only log in once and subsequent sessions will be redirected to the original session.

To change this setting, you'll need to perform a registry change. The following steps describe the process:

1- Start Registry Editor (by default, this is located at c:\windows\regedit.exe).
2- Go to the following registry key:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TerminalServer
3- If the fSingleSessionPerUser value doesn't exist, create a new DWORD value named fSingleSessionPerUser
4- Open the fSingleSessionPerUser value. The possible values for this setting are as follows:
0x0 -- Allow multiple sessions per user
0x1 -- Force each user to a single session
5- Enter the new setting, and then click OK.

Reference: http://www.thomasmaurer.ch/2010/10/windows-server-2008-allow-multiple-remote-desktop-sessions-per-user/

Wednesday, November 16, 2011

/etc/network/interfaces Format


The file illustrates itself . .

The file path for debian and ubuntu is /usr/share/doc/ifupdown/examples/network-interfaces

######################################################################
# /etc/network/interfaces -- configuration file for ifup(8), ifdown(8)
#
# A "#" character in the very first column makes the rest of the line
# be ignored. Blank lines are ignored. Lines may be indented freely.
# A "\" character at the very end of the line indicates the next line
# should be treated as a continuation of the current one.
#
# The "pre-up", "up", "down" and "post-down" options are valid for all
# interfaces, and may be specified multiple times. All other options
# may only be specified once.
#
# See the interfaces(5) manpage for information on what options are
# available.
######################################################################

# We always want the loopback interface.
#
# auto lo
# iface lo inet loopback

# An example ethernet card setup: (broadcast and gateway are optional)
#
# auto eth0
# iface eth0 inet static
#     address 192.168.0.42
#     network 192.168.0.0
#     netmask 255.255.255.0
#     broadcast 192.168.0.255
#     gateway 192.168.0.1

# A more complicated ethernet setup, with a less common netmask, and a downright
# weird broadcast address: (the "up" lines are executed verbatim when the
# interface is brought up, the "down" lines when it's brought down)
#
# auto eth0
# iface eth0 inet static
#     address 192.168.1.42
#     network 192.168.1.0
#     netmask 255.255.255.128
#     broadcast 192.168.1.0
#     up route add -net 192.168.1.128 netmask 255.255.255.128 gw 192.168.1.2
#     up route add default gw 192.168.1.200
#     down route del default gw 192.168.1.200
#     down route del -net 192.168.1.128 netmask 255.255.255.128 gw 192.168.1.2

# A more complicated ethernet setup with a single ethernet card with
# two interfaces.
# Note: This happens to work since ifconfig handles it that way, not because
# ifup/down handles the ':' any differently.
# Warning: There is a known bug if you do this, since the state will not
# be properly defined if you try to 'ifdown eth0' when both interfaces
# are up. The ifconfig program will not remove eth0 but it will be
# removed from the interfaces state so you will see it up until you execute:
# 'ifdown eth0:1 ; ifup eth0; ifdown eth0'
# BTW, this is "bug" #193679 (it's not really a bug, it's more of a
# limitation)
#
# auto eth0 eth0:1
# iface eth0 inet static
#     address 192.168.0.100
#     network 192.168.0.0
#     netmask 255.255.255.0
#     broadcast 192.168.0.255
#     gateway 192.168.0.1
# iface eth0:1 inet static
#     address 192.168.0.200
#     network 192.168.0.0
#     netmask 255.255.255.0

# "pre-up" and "post-down" commands are also available. In addition, the
# exit status of these commands are checked, and if any fail, configuration
# (or deconfiguration) is aborted. So:
#
# auto eth0
# iface eth0 inet dhcp
#     pre-up [ -f /etc/network/local-network-ok ]
#
# will allow you to only have eth0 brought up when the file
# /etc/network/local-network-ok exists.

# Two ethernet interfaces, one connected to a trusted LAN, the other to
# the untrusted Internet. If their MAC addresses get swapped (because an
# updated kernel uses a different order when probing for network cards,
# say), then they don't get brought up at all.
#
# auto eth0 eth1
# iface eth0 inet static
#     address 192.168.42.1
#     netmask 255.255.255.0
#     pre-up /path/to/check-mac-address.sh eth0 11:22:33:44:55:66
#     pre-up /usr/local/sbin/enable-masq
# iface eth1 inet dhcp
#     pre-up /path/to/check-mac-address.sh eth1 AA:BB:CC:DD:EE:FF
#     pre-up /usr/local/sbin/firewall

# Two ethernet interfaces, one connected to a trusted LAN, the other to
# the untrusted Internet, identified by MAC address rather than interface
# name:
#
# auto eth0 eth1
# mapping eth0 eth1
#     script /path/to/get-mac-address.sh
#     map 11:22:33:44:55:66 lan
#     map AA:BB:CC:DD:EE:FF internet
# iface lan inet static
#     address 192.168.42.1
#     netmask 255.255.255.0
#     pre-up /usr/local/sbin/enable-masq $IFACE
# iface internet inet dhcp
#     pre-up /usr/local/sbin/firewall $IFACE

# A PCMCIA interface for a laptop that is used in different locations:
# (note the lack of an "auto" line for any of these)
#
# mapping eth0
#    script /path/to/pcmcia-compat.sh
#    map home,*,*,*                  home
#    map work,*,*,00:11:22:33:44:55  work-wireless
#    map work,*,*,01:12:23:34:45:50  work-static
#
# iface home inet dhcp
# iface work-wireless bootp
# iface work-static static
#     address 10.15.43.23
#     netmask 255.255.255.0
#     gateway 10.15.43.1
#
# Note, this won't work unless you specifically change the file
# /etc/pcmcia/network to look more like:
#
#     if [ -r ./shared ] ; then . ./shared ; else . /etc/pcmcia/shared ; fi
#     get_info $DEVICE
#     case "$ACTION" in
#         'start')
#             /sbin/ifup $DEVICE
#             ;;
#         'stop')
#             /sbin/ifdown $DEVICE
#             ;;
#     esac
#     exit 0

# An alternate way of doing the same thing: (in this case identifying
# where the laptop is is done by configuring the interface as various
# options, and seeing if a computer that is known to be on each particular
# network will respond to pings. The various numbers here need to be chosen
# with a great deal of care.)
#
# mapping eth0
#    script /path/to/ping-places.sh
#    map 192.168.42.254/24 192.168.42.1 home
#    map 10.15.43.254/24 10.15.43.1 work-wireless
#    map 10.15.43.23/24 10.15.43.1 work-static
#
# iface home inet dhcp
# iface work-wireless bootp
# iface work-static static
#     address 10.15.43.23
#     netmask 255.255.255.0
#     gateway 10.15.43.1
#
# Note that the ping-places script requires the iproute package installed,
# and the same changes to /etc/pcmcia/network are required for this as for
# the previous example.


# Set up an interface to read all the traffic on the network. This
# configuration can be useful to setup Network Intrusion Detection
# sensors in 'stealth'-type configuration. This prevents the NIDS
# system to be a direct target in a hostile network since they have
# no IP address on the network. Notice, however, that there have been
# known bugs over time in sensors part of NIDS (for example see
# DSA-297 related to Snort) and remote buffer overflows might even be
# triggered by network packet processing.
#
# auto eth0
# iface eth0 inet manual
#       up ifconfig $IFACE 0.0.0.0 up
#       up ip link set $IFACE promisc on
#       down ip link set $IFACE promisc off
#       down ifconfig $IFACE down

# Set up an interface which will not be allocated an IP address by
# ifupdown but will be configured through external programs. This
# can be useful to setup interfaces configured through other programs,
# like, for example, PPPOE scripts.
#
# auto eth0
# iface eth0 inet manual
#       up ifconfig $IFACE 0.0.0.0 up
#       up /usr/local/bin/myconfigscript
#       down ifconfig $IFACE down

Tuesday, November 1, 2011

DHCP Server on Debian


With the Dynamic Host Configuration Protocol (DHCP) the computers within the network can get the required information to connect to the internet (IP Address, Gateway Address, DNS Server address and others)


On a Debian machine, it's quite simple to setup and configure a DHCP server:


1- Installation
apt-get install isc-dhcp-server
2- Configuration


The configuration file for a dhcp-server is /etc/dhcp/dhcpd.conf, edit it as follows: 
- Choose whatever domain name you like ex. home.local:
option domain-name "home.local";
- Define the DNS servers to use, you can use your private DNS server or any public one like the 8.8.8.8 or 4.2.2.4:
option domain-name-servers 8.8.8.8, 4.2.2.4; 
- Define the gateway IP address:
option routers 192.168.1.1;
- Define the range of addresses that will be distributed by the DHCP server :
subnet 192.168.1.0 netmask 255.255.255.0 {range 192.168.1.50 192.168.1.100;}
- To assign a fixed address to a particular machine (WebServer):
host WebServer{hardware ethernet 00:0D:87:B3:AE:A6;fixed-address 192.168.1.55;}
where  00:0D:87:B3:AE:A6 is the MAC address of the WebServer machine and 192.168.1.55 is the required IP address to be assigned.


HINTS: 
  1. Start the server by /etc/init.d/isc-dhcp-server start to take effect.
  2. Don't forget to edit the /etc/default/isc-dhcp-server file for INTERFACES="eth0" where eth0 is the interface through which to accept DHCP requests from clients.

Source Link: http://wiki.debian.org/DHCP_Server

Monday, October 10, 2011

ESXi Virtual Adapter in Promiscuous Mode

To install Firewalls, Port Sniffers, IDS, etc as guest virtual machines on an ESXi host which need network adapters working in promiscuous mode, it's not enough to put the virtual adapters in promiscuous mode, but you need as well to allow promiscuous mode on the vSwitch in which those virtual adapters are connected to.


To configure a portgroup or virtual switch to allow promiscuous mode:
  1. Log in to the ESX/ESXi host or vCenter Server using vSphere Client.
  2. Select the ESX/ESXi host in the inventory.
  3. Click the Configuration tab.
  4. In the Hardware section , click Networking.
  5. Click Properties of the virtual switch for which you want to enable promiscuous mode.
  6. Select the virtual switch or portgroup you wish to modify and click Edit.
  7. Click the Security tab.
  8. From the dropdown for Promiscuous Mode, select Accept.
HINTS: 
  • Software running inside a virtual machine may be able to monitor any and all traffic moving across a vSwitch if it is allowed to enter promiscuous mode. 
  • The setting on the portgroup overrides the virtual switch setting.
  • Placing the guest adapter in promiscuous mode causes it to detect all frames passed on the virtual switch that are allowed under the VLAN policy for the associated portgroup.

Sunday, October 9, 2011

Linux Brdige

Installing the software


The program you’re going to need is called brctl and is included in bridge-utils. Find it in Synaptic, or install it using this command:
aptitude install bridge-utils
This program will allow us to set up and use the bridge interface. The bridge interface appears as a new interface in ip link, much like eth0 or eth1. It doesn’t physically exist on your computer, but instead it is a virtual interface that just takes the packets from one physical interface, and transparently routes them to the other.


Setting up your Bridge


Manual bridge setup


First step to creating the bridge network is actually creating it. Issue this command to get the ball rolling and create the new interface.
brctl addbr br0
The name br0 is totally up to you, this is just an example name that I’ve chosen for the wiki article. Anyway, now that you have your bridge device, you have to add the interfaces that are gonna be bridged. You can cross-check the enumeration of your ethernet devices with (eth0, eth1, etc. is common):
ip addr show
Add both the interface with the second computer, and the interface that leads to the existing network. Do it with this command:
brctl addif br0 eth0 eth1
This will add the two interfaces eth0 and eth1 to bridge br0. Simple enough. There’s no distinction with how you add the bridges, or what order you do it, or any special commands you have to add to distinguish them. So don’t worry about that.


Well, now we have our bridges, so bring all the interfaces up, and you’ll be set!


Configuring bridging in /etc/network/interfaces


- To make your bridge a little more permanent, you’re gonna need to edit /etc/network/interfaces. Using our example names, make it look like this and you’re set (if you want to use DHCP):



 # This file describes the network interfaces available on your system
 # and how to activate them. For more information, see interfaces(5).

 # The loopback network interface
 auto lo br0
 iface lo inet loopback


 # Set up interfaces manually, avoiding conflicts with, e.g., network manager
 iface eth0 inet manual
 iface eth1 inet manual


 # Bridge setup
 iface br0 inet dhcp
 bridge_ports eth0 eth1


To bring up your bridge, you just have to issue  # ifup br0 and it’ll bring up the other necessary interfaces without anything in your interfaces file about the bridged interfaces.


- If you like static IP’s, then you can just add the static IP options under the br0 interface setup. Kinda like this:



 # This file describes the network interfaces available on your system
 # and how to activate them. For more information, see interfaces(5).

 # The loopback network interface
 auto lo br0
 iface lo inet loopback


 # Set up interfaces manually, avoiding conflicts with, e.g., network manager
 iface eth0 inet manual
 iface eth1 inet manual


 # Bridge setup
 iface br0 inet static
        bridge_ports eth0 eth1
        address 192.168.1.2
        broadcast 192.168.1.255
        netmask 255.255.255.0
        gateway 192.168.1.1


Source Link: http://wiki.debian.org/BridgeNetworkConnections

Cisco NTP Client Configuration

Display the system clock

Use the show clock command in EXEC mode, enter:

show clock
OR
show clock detail
The last example will show the clock source (such as NTP) and the current summer time setting etc.

Set the system clock manually

To set the time use the following 24 hour time format:
clock set 20:30:13 July 2009
The syntax is as follows:

clock set hh:mm:ss day month year
OR
clock set hh:mm:ss month day year

Set the system clock via NTP server

The more recent versions of IOS (version 10+) support NTP version 4.
To make your router synchronize with a ClockWatch NTP server with the IP address of 192.168.1.1, use the IOS commands:

Router> enable
password: *********
Router# config t
Router(config)# ntp server 192.168.1.1
Router(config)# exit
Router# wr mem

The NTP server command forms a server association with the ClockWatch server. The Cisco router then goes through the process of validating the ClockWatch server. This may be immediate or take several minutes. You can confirm it has been synchronized by showing the NTP associations:

Router>show ntp associations

address ref clock st when poll reach delay offset disp
*~192.168.1.1 .CLKW. 1 35 64 377 23.9 -0.45 1.2

The star (*) displayed next to the configured (~) peer indicates the router is synchronized with ClockWatch. A pound sign (#)  indicates that the router isn't syncing with ClockWatch even though NTP request and response packets are being exchanged. In this case, check the output of the show ntp associations detail command or enable the NTP debugs to see why the clocks aren't syncing. 

One possible reason for the failure to sync is that the NTP client's clock differs by more than 4000 seconds from ClockWatch's clock. On Cisco routers, a time difference of greater than 4000 seconds is considered out of range, and prevents the router from syncing to the server. This doesn't apply when you first configure an NTP peer on a Cisco router or at a reload. In this case, the NTP client's (the Cisco router's) clock is changed to match the NTP server's clock, no matter how large the difference.

Tips:

- Check that ClockWatch Server has been synchronized to an external timeserver within the last 24 hours. This is a NTP server qualification requirement of the Cisco NTP client implementation.

- ClockWatch does not support authentication. Turn off authentication by issuing the IOS configuration command no ntp authentication. Authentication is normally turned on in IOS version 12.4 and above.

- You can manually change the client's clock (using the clock set command) to within a few minutes of the ClockWatch Server's clock to facilitate the synchronization.

- Make sure you check the time zone of the client's clock; local time is displayed, but time values in NTP messages are stored in UTC (GMT).

Source Links: