Filter:

Submit Search

IMPORTANT
SNS 3.x versions have reached End of Maintenance since July 1st, 2024.
We recommend that you update your SNS firewalls to a version with maintenance to guarantee the protection of your infrastructure.

# IPS tab

## Allow version

Select the checkboxes corresponding to the versions of the NTP protocol that you wish to analyze. The packets corresponding to the unselected versions will raise the alarm "NTP: version denied" and will be blocked by the firewall.

Version 1 | By selecting this option, you will be enabling the intrusion prevention analysis for NTP version 1.
Version 2 | By selecting this option, you will be enabling the intrusion prevention analysis for NTP version 2.
Version 3 | By selecting this option, you will be enabling the intrusion prevention analysis for NTP version 3.
Version 4 | By selecting this option, you will be enabling the intrusion prevention analysis for NTP version 4.

## General Settings

Max. number of pending requests | Maximum number of requests without responses in a single NTP session. This value has to be between 1 and 512 seconds (default value: 10).
Maximum request duration (seconds) | This value is the period after which NTP requests without responses will be deleted. This value has to be between 1 and 3600 seconds (default value: 10).

## Protection against Time Poisoning attacks

Clock skew threshold allowed (minutes) | This parameter indicates the highest clock skew that an NTP server can send to an NTP client. Above the indicated value (default value: 20 minutes), the client host that sends NTP requests will be considered the target of a Time Poisoning attack and will set off the alarm ntp:463 "NTP: possible poisoning attack" (block alarm by default) .

## Support

Disable intrusion prevention | When this option is selected, the scan of the NTP protocol will be disabled and traffic will be authorized if the filter policy allows it
Log each request in NTP client mode | Enables or disables the logging of NTP requests.