Subject: NTP

From: Ken Vescovi <[email-masked]>
Date: Sun, 22 Jun 1997 23:58:59 -0400

>My feeling is that no site should be sending NTP *multicasts* outside
> their "site" ("link-local", "site-local", or "organization-local"
> should be the limits for the scope, in IPv6 multicasting-speak, but
> never "global").  Is this reasonable?

Maybe one way to set up NTP on your internal network is  to recive it from
your local router.  The router then should be set up (Speaking Cisco) to
receive packets from an upstream source who has stratum 1 traceability.
Cisco routers have the ability to receive from several sources with one of
these being a preferred source.  We set up our routers to look upstream for
the preferred source and also to our bastion host in our firewall system.
In this manner, NTP packets are only allowed through our filtering list from
this trusted host.  This host and our router terminating our Internet
connection look for NTP packets from a stratum 1 source.  This minimizes
traffic on the network while maintaining security and stratum 1 traceability.

Ken
Ken Vescovi
Senior Network Engineer
Concurrent Technologies Corporation
1450 Scalp Ave
Johnstown, PA 15904		814.269.2687		aka [email-masked]