Re: Time syncing firewalls

["Steven M. Bellovin" <smb () research att com>]

In message <Pine.GSO.4.20.9912021309200.26387-100000 () carerra corp vicinity com>
, "Aaron D. Turner" writes:
> We're using a number of FW-1 firewalls with SKIP to provide VPN
> services between various locations around the world.  One problem
> we're seeing is that every few weeks the VPN will go down for no
> apparent reason.  After talking with Checkpoint, the consensus appears
> to be that the firewalls are having clock drift which SKIP is very
> sensitive too.

You could switch to real IPsec...
> So, I was wondering what other people were using for secure
> time-syncing firewalls running on Solaris.  NTP?  timed?  I'd prefer
> NTP so that I can keep the firewalls in sync with other equipment
> which generates logs for log syncing purposes, though I'm a bit
> concerened about opening another port on the firewalls.

GPS receivers are cheap, and they can serve as stratum 1 NTP clocks.  Set up 
your own, internal NTP mesh, using at least two stratum 1 clocks in different 
locations.

                --Steve Bellovin