Configuring time synchronization via the NTP and PTP protocols

The time on nodes that have Kaspersky Industrial CyberSecurity for Networks components installed must be synchronized with a common source of time used by industrial network devices. For synchronization purposes, you can use the standard protocols known as Network Time Protocol (NTP) and Precision Time Protocol (PTP).

On the Server node, you must configure time synchronization regardless of how this component was installed (after centralized installation as well as after local installation).

On nodes hosting installed sensors, you must configure time synchronization in the following cases:

Automatic time synchronization between the Server and sensors was not enabled during centralized installation of Kaspersky Industrial CyberSecurity for Networks.
The sensor was installed locally using the kics4net-install.sh script.

The steps required for configuring time synchronization may differ depending on the version of the operating system and the specific protocol.

Configuring time synchronization via the NTP protocol in CentOS
1. Open the operating system console.
2. Check the status of the standard time synchronization service known as chrony. To do so, enter the following command:
  systemctl status chronyd
3. If the service is not found, enter the following commands to add the package and enable the service:
  sudo dnf install chrony
  sudo systemctl enable chronyd
  sudo systemctl start chronyd
4. Open the service configuration file. To do so, enter the following command:
  sudo mcedit /etc/chrony.conf
5. Specify the NTP servers that will be used for time synchronization. To specify the server, you only need to add the following string:
  server <server name or IP address> iburst
6. Save and close the configuration file.
7. Restart the service. To do so, enter the following command:
  sudo systemctl restart chronyd
8. Verify that the specified NTP servers are on the list of synchronization sources. To do so, enter the following command:
  chronyc sources
Configuring time synchronization via the PTP protocol in CentOS
1. Open the operating system console.
2. Check whether the linuxptp package is installed. To do so, enter the following command:
  dnf list installed
3. If the linuxptp package is not installed, enter the following commands to add the package and enable the ptp4l time synchronization service:
  sudo dnf install linuxptp
  sudo systemctl enable ptp4l
  sudo systemctl start ptp4l
4. Open the service configuration file. To do so, enter the following command:
  sudo mcedit /etc/ptp4l.conf
5. Enter 1 for the slaveOnly parameter.
6. Save and close the configuration file.
7. Open the file containing the general settings for the service. To do so, enter the following command:
  sudo mcedit /etc/sysconfig/ptp4l
8. In the OPTIONS string, specify the parameters as follows:
  OPTIONS="-f <configuration file> -i <interface name> -S -s"
  
  where:
  - -f <configuration file> – default name and full path of the configuration file.
  - -i <interface name> – name of the network interface that is used for time synchronization.
  - -S – enables use of software-based timestamps. You can skip this switch if you want to use hardware-based timestamps. However, first make sure that the equipment supports this capability.
  - -s – enables subordinate time synchronization.
  Example OPTIONS string:
  
  OPTIONS="-f /etc/ptp4l.conf -i eth0 -S -s"
9. Save and close the general settings file.
10. Allow use of ports 319 and 320 in the firewall. To do so, enter the following commands:
  sudo firewall-cmd --permanent --add-port=319/udp
  sudo firewall-cmd --permanent --add-port=320/udp
11. Restart the firewall service. To do so, enter the following command:
  sudo systemctl restart firewalld
12. Restart the time synchronization service. To do so, enter the following command:
  sudo systemctl restart ptp4l

Page top