The firewall implementation must synchronize internal system clocks on an organizationally defined frequency with an organizationally defined authoritative time source.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000097-FW-000063	SRG-NET-000097-FW-000063	SRG-NET-000097-FW-000063_rule		Low

Description
The various components within the network infrastructure providing the log records must have their clocks synchronized using a common time reference, so the events can be correlated in exact order of time. Without synchronized time, accurately correlating information between devices becomes difficult, if not impossible. If firewall logs cannot be correlated with the routers, switches, and firewall, it may not be possible to trace all the damage caused by a network breach. The firewall implementation must be configured to use a minimum of two Network Time Protocol (NTP) servers to synchronize time. NTP provides an efficient and scalable method for network elements to synchronize to an accurate time source.

Description

The various components within the network infrastructure providing the log records must have their clocks synchronized using a common time reference, so the events can be correlated in exact order of time. Without synchronized time, accurately correlating information between devices becomes difficult, if not impossible. If firewall logs cannot be correlated with the routers, switches, and firewall, it may not be possible to trace all the damage caused by a network breach. The firewall implementation must be configured to use a minimum of two Network Time Protocol (NTP) servers to synchronize time. NTP provides an efficient and scalable method for network elements to synchronize to an accurate time source.

STIG	Date
Firewall Security Requirements Guide	2012-12-10

Details

Check Text ( C-SRG-NET-000097-FW-000063_chk )
Review the firewall configuration and verify at least two NTP servers are defined. Verify the NTP synchronization updates the system clocks on an organizationally defined time period. If the firewall implementation does not synchronize internal system clocks on an organizationally defined frequency with at least two organizationally defined, authoritative NTP servers, this is a finding.

Fix Text (F-SRG-NET-000097-FW-000063_fix)
Specify two organizationally defined, authoritative NTP server IP addresses on the device in the firewall configuration. Configure synchronization with the NTP server to update the internal system clocks of each firewall on an organizationally defined frequency