CloudLabBox
Try the free demo

Network+ lab 15 of 27

Time and logs: NTP and syslog

Logs are useless if every device keeps different time. You build an NTP hierarchy with authentication, set the UK time zone and summer time, then send every device's logs to a central collector with the right severity, timestamps and origin, and use them to reconstruct an incident.

Run this lab

It needs Lite: its 4 nodes are set to 4 vCPU and 2,304 MB in total. That fits the free demo too.

In your workspace: Shared, then CompTIA Network Plus N10-009 guided labs, then 15 - Time and logs - NTP and syslog

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 55 minutes
Nodes need
4 vCPU, 2,304 MB
Smallest plan
Lite

The scenario

Last week a Harbour Logistics branch link went down for a few minutes. Afterwards nobody could say which device noticed first: each router and switch had its own idea of the time, and the logs had stayed on the devices, partly overwritten. You'll fix both problems. Every device gets its time from R1 (head office's time source) and sends its logs to the collector LOG1.

DeviceAddressRole
R110.10.10.1 (LAN), 10.0.12.1 (to R2)NTP server for the site (stratum 3)
R210.0.12.2branch router, NTP client with authentication
SW110.10.10.2switch, NTP client
LOG110.10.10.50Linux syslog collector

Settings (teaching values): time zone GMT with British Summer Time; NTP key 1, MD5, Harb0ur-NTP; syslog to 10.10.10.50 at severity informational, with the device's hostname as origin ID.

What you’ll practise

  • Explain NTP strata and why synchronised time matters for logs and security
  • Configure an NTP server, clients and NTP authentication
  • Set time zones, summer time and log timestamps
  • Send syslog to a central collector with a severity level and an origin ID
  • Read syslog severity levels 0 to 7 and filter on them
  • Correlate events from several devices on one timeline

The tasks

  1. Start the collector
  2. See the problem
  3. Build the NTP hierarchy
  4. Authenticate NTP to the branch
  5. Time zone, summer time and timestamps
  6. Send the logs to the collector
  7. Reconstruct an incident

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Time and logs - NTP and syslog4 nodes, 3 links. Every link is listed as text below the diagram.R1R2SW1LOG1Gi0/0Gi0/0Gi0/1eth0Gi0/1Gi0/0
4 nodes, with the interface names each link uses.
Every link, as text
  • R1 Gi0/1 to R2 Gi0/0
  • R1 Gi0/0 to SW1 Gi0/0
  • SW1 Gi0/1 to LOG1 eth0
Nodes in Time and logs: NTP and syslog, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
R1Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
R2Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
SW1Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 768 MB
LOG1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CompTIA Network Plus N10-009 guided labs.

  3. Open 15 - Time and logs - NTP and syslog and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Network+ labs

All Network+ labs

Related labs in other courses

CloudLabBox is independent of CompTIA, Cisco and Netgate. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.