Re: [c-nsp] NTP network design considerations

2022-10-14 Thread Gert Doering via cisco-nsp
Hi, On Fri, Oct 14, 2022 at 03:07:47PM -0400, Aaron wrote: > You can setup a raspberry pi as a server and do GPS. Not sure on the > scalability (how many devices it can handle) of that but it does work. For a true time geek, the time the rPIs provide is just not good enough (fluctuates +/- 20

Re: [c-nsp] NTP network design considerations

2022-10-14 Thread Gert Doering via cisco-nsp
Hi, On Fri, Oct 14, 2022 at 02:41:45PM -0400, harbor235 wrote: > I hear what your saying but NTP is an active attack vector, I don't trust > outside resources implicitly and traffic segmentation is a prudent measure > especially if you are getting internet time. Now if you have your own >

Re: [c-nsp] NTP network design considerations

2022-10-14 Thread Aaron via cisco-nsp
You can setup a raspberry pi as a server and do GPS. Not sure on the scalability (how many devices it can handle) of that but it does work. I would do at least 3 in different servers/locations, then have my routers slave off them and peer with each other. It is internal and is cheap. There are a

Re: [c-nsp] NTP network design considerations

2022-10-14 Thread harbor235 via cisco-nsp
I hear what your saying but NTP is an active attack vector, I don't trust outside resources implicitly and traffic segmentation is a prudent measure especially if you are getting internet time. Now if you have your own stratum1 then I understand your point more. Mike On Fri, Oct 14, 2022 at

Re: [c-nsp] NTP network design considerations

2022-10-14 Thread Gert Doering via cisco-nsp
Hi, On Fri, Oct 14, 2022 at 10:27:16AM -0400, harbor235 via cisco-nsp wrote: > How are you integrating NTP into your infrastructures? Is it part of your > management network(s)? NTP servers (appliances from Meinberg and regular FreeBSD servers, basically) are just sitting "on the Internet" and

[c-nsp] NTP network design considerations

2022-10-14 Thread harbor235 via cisco-nsp
To all, How are you integrating NTP into your infrastructures? Is it part of your management network(s)? In the past it used to be that the management network was a flat network, now we deploy north of the FW security zone management network and south of the FW security zone management network.