Using 127.127.1.1 as an NTP source

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

In an NTP client, it is possible to configure as the NTP server IP address 127.127.1.1 and for it to show as sys_peer

Is this a safe configuration for a cluster ?

 

Cause

For the NTP protocol, address 127.127.1.1 represents the local clock, which means it is pulling the time from the local clock and considering itself synchronized. So specifying this in any cluster node tells the node to consider whatever local system time there is as ntp-synchronized. Thus, a cluster configuration with all its members using 127.127.1.1 as ntp source will consider itself synchronized and it will be able to start, without ensuring that the time for the nodes is really the same for all cluster members

This may lead to inconsistencies and unsynchronized database copies

Resolution

It is not recommended to use 127.127.1.1 as an ntp source, even if it shows as sys_peer. It could be used in an emergency situation or for testing, but never as a permanent solution and never in a production environment. For a reliable production cluster, please make sure that there is an external ntp server specified for each node that provides synchronization (the same server or different ones, depending on reachability)