1.Cisco ASA Clock Configuration

The Cisco ASA firewall has a battery on the motherboard that saves the clock settings. Even when it’s is powered off, the clock will be stored. There are two important reasons why you want to make sure that your ASA has the correct date/time:

• In case of a security breach you want to track log files for events. With an incorrect timestamp, your log files are useless.
• PKI (Public Key Infrastructure) that we use for digital certificates to authenticate remote users (IPSEC or SSL VPN) requires the correct date/time.

The most simple method is to configure the date/time manually, you can do it like this:

ASA1(config)# clock set 13:15:00 Dec 19 2014

Just use the clock set command and enter the correct time/date. You can verify it like this:

ASA1# show clock
13:15:15.709 UTC Fri Dec 19 2014

As you can see, the default timezone is UTC. If you are in another timezone like me then you have to change this:

ASA1(config)# clock timezone CET +1

Use the clock timezone command to change the timezone. You can pick whatever name you want for the timezone but you have to specify the offset from UTC. CET is 1 hour ahead of UTC so that’s why I configured +1.

Here in the Netherlands (and most of central Europe) we use summertime, it’s called CEST (Central Europe Summer Time) and we have to tell the ASA when it starts and ends:

ASA1(config)# clock summer-time CEST recurring last Sun Mar 02:00 last Sun Oct 03:00

Summertime starts at the last sunday in march at 02:00 and ends on the last sunday in October, 03:00.

Instead of configuring the clock manually, it’s better to use a external NTP server to keep your clock synchronized. You can configure the NTP client on the ASA like this:

ASA1(config)# ntp server 192.168.1.1 source INSIDE

Configure the IP address of the NTP server, specifying the source IP address is optional but I used the inside interface. It will take a while to synchronize, you can verify NTP like this:

ASA1# show ntp status 
Clock is synchronized, stratum 2, reference is 192.168.1.1
nominal freq is 99.9984 Hz, actual freq is 99.9984 Hz, precision is 2**6
reference time is d83ea133.25417215 (14:05:55.145 CET Fri Dec 19 2014)
clock offset is -8.6115 msec, root delay is 1.40 msec
root dispersion is 15899.48 msec, peer dispersion is 15890.63 msec

Optionally you can enable authentication for NTP. This is probably a good idea since it’s a critical service:

ASA1(config)# ntp authenticate
ASA1(config)# ntp authentication-key 1 md5 MY_PASSWORD
ASA1(config)# ntp trusted-key 1
ASA1(config)# ntp server 192.168.1.1 key 1 source INSIDE

We enabled NTP authentication and configured a key with a password. We tell the ASA that key 1 is trusted and to use this key to authenticate the NTP server. That’s all there is to it, I hope this lesson has helped to keep your clocks synchronized.