Reference Clocks on a Secured Network



A proper approach for using reference clocks is to setup reference clocks on appropriately secured management networks. A true reference clock can be expensive to obtain and maintain, but a variety of devices that sync to the correct time using long wave radio signals, CDMA technology, or GPS transmissions are also available. These devices are available for about US$600 and up. These are generally much cheaper and still provide time within a few milliseconds. In most datacenter environments, these are the most appropriate solution. GPS receivers need to be mounted on the roof or in a window, and even radio receivers may have problems operating in a shielded room. Additionally, to prevent a clock failure or an incorrect clock from affecting the clients time, it is best to have at least 3 independent time sources. If no public NTP servers are used, this means at least 3 reference clocks. Because of these restrictions, it may be difficult to have reference clocks available behind the firewall unless a site is willing to invest a great deal in infrastructure and design.

Local Clock as a Reference Clock

Using the server's local clock as a reference clock is almost always a bad idea, especially if the server is in broadcast mode, because its time will wander and could eventually differ significantly from UTC. For details on how badly local clocks can wander, refer to the section, ?Time in a Networked Environment? in the first article of this series.

NTP provides an excellent means of keeping a large number of nodes in close synchronization. An effectively designed NTP infrastructure can accomplish this with a minimum of network overhead and can also maintain a high level of accuracy and security. In addition, NTP solutions are relatively easy to architect and implement, making them ideal for everything from a small business to wide area enterprise deployments. The clock synchronization afforded by NTP can be useful for a variety of purposes, including keeping time stamps on different network nodes in sync, which enables easier network and security troubleshooting.