Time syncing firewalls

["Aaron D. Turner" <aturner () vicinity com>]

We're using a number of FW-1 firewalls with SKIP to provide VPN
services between various locations around the world.  One problem
we're seeing is that every few weeks the VPN will go down for no
apparent reason.  After talking with Checkpoint, the consensus appears
to be that the firewalls are having clock drift which SKIP is very
sensitive too.

So, I was wondering what other people were using for secure
time-syncing firewalls running on Solaris.  NTP?  timed?  I'd prefer
NTP so that I can keep the firewalls in sync with other equipment
which generates logs for log syncing purposes, though I'm a bit
concerened about opening another port on the firewalls.

Comments?

-- 
Aaron Turner        aturner () vicinity com  650.237.0300 x252
Security Engineer                         Vicinity Corp.        
Cell: 408-314-9874  Pager: 650-317-1821   http://www.vicinity.com