• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Configuring NTP correctly

J

joshu

Limp Gawd
Joined
Aug 11, 2011
Messages
160
Assuming a network consists of a single or multiple vSphere ESXi 5 hosts, printer, thin client, ADSL modem and physical switch. Also, the firewall/ router is virtual.

My understanding is that it is "best practice" to have a single device connect to an external (via Internet) NTP server and then act as the local NTP server for the local network devices.

In the scenario I describe above what device is appropriate to designate as the local NTP server? I assume that it can't be a virtual machine as in the worst case scenario all vSphere hosts are powered off.


Thanks
 
The list above doesn't sound like it has any hosts which would be able to run ntp (maybe the adsl unit if it's also a router?), so i can't think what to do aside from having it be on a VM. if everything is shut down, who would need ntp? or are there clients you haven't mentioned?
 
danswartz said:
The list above doesn't sound like it has any hosts which would be able to run ntp (maybe the adsl unit if it's also a router?), so i can't think what to do aside from having it be on a VM. if everything is shut down, who would need ntp? or are there clients you haven't mentioned?
Click to expand...

The ADSL modem is just a modem in bridge-mode.

Perhaps I should clarify that the physical switch is a smart switch with VLAN capability etc. Most likely an HP ProCurve 1810.
 
Probably only has ntp as a client then. I think your best bet is to just run ntp on a VM. It's not fatal if ntp is unavailable for some period of time - clients will just run off their internal clocks until they can sync.
 
Ah right it has to support acting as an NTP server. Opps missed that :eek:

Would it be better to point all devices to an external NTP server rather than running a local NTP server in a virtual machine as you suggested?

If the local NTP server is a VM. Which VM is suitable? The first one that power up, e.g. the firewall/router ?
 
Probably doesn't much matter. The clients will keep trying until the ntp server responds. I wouldn't over-analyze this :)
 
The key thing is that the time doesn't have to be accurate (but that's a good thing) it just has to match on all devices. ;)

In your case I'd point them outside to like pool.ntp.org. That's what I do in my lab. If you have a larger network then you'd put up a NTP server somewhere internal that pulled time external. That's what I did when I managed networks. Linux box that I also used for syslog or something like that. Any VM is fine..it's not like NTP is a Tier 1 application. If a box can't check NTP for a while it's not a big deal.
 
Ok so I'll configure every hardware device (ipmi, switch etc) and all VMs to point to se.pool.ntp.org (located in Sweden.)

Regarding the VMs, if each one syncs with se.pool.ntp.org then I should disable VMware Tools host syncing, correct?
 
It is probably better to have all the virtual hosts sync to the hypervisor, then the hypervisor sync via ntp to the pool since ntp keeps statistics on how much the local clock drifts to help keep the local clock in sync.

Since interrupt timings are not absolutely correct in any virtual machine, the clock drift statistics will be all over the board, and may make the local clock more inaccurate overall.
 
You must log in or register to reply here.
Back
Top