Re: [Ntp] Antw: [EXT] Re: NTS4UPTP draft

[Doug Arnold <[e-mail]>]

PTP over VPN might work.  VPNs are usually carry encrypted traffic and that could lead to a lot of timestamp jitter, if the nodes decrypt messages before deciding whether it should be timestamped or not.

Doug

On 6/7/21, 3:48 AM, "Heiko Gerstung" <heiko.gerstung=[e-mail]> wrote:
>>>> Doug Arnold <doug.arnold=[e-mail]<mailto:doug.arnold=[e-mail]>> schrieb am
> 04.06.2021 um 18:45 in Nachricht
>
> <[e-mail]<mailto:[e-mail]>>
>
>> I always recommend to network operators that  If you are transfer time across
>> the Internet it should be NTP.  Nevertheless, Inevitably someone is going to
>> run PTP this way.  However, I don’t know that it is something that we need to
>> protect or encourage.
>> People do run PTP over large telecom networks.  Power grid operators
>> sometime run PTP between substations on large telecom like networks to back
>> up GNSS.  Financial data centers sometime like to get time over fiber from a
>> remote national lab.  These applications will likely eventual want to improve
>> the robustness by a having a secure version of PTP.

> Hi!
>
> Another question is: if PTP is used mostly for corporate "private" networks,
> wouldn't "PTP over VPN" do?

It would probably do the trick in some cases, but not in all of them. Especially if you have to set up a VPN infrastructure for a nationwide telecommunication network where you want to synchronize 20k+ devices.

> If companies have a "private (more or less) fiber", isn't that "security
> enough"?
No. Does your company use SSH or HTTPS or other encrypted/security protocols in your internal LAN?

> I mean NTP being a "public" protocol, the "NTP over VPN" wouldn't work.
> (Timing-issues left aside)
One of the reasons PTP is not used over public networks is the fact that it is not secure as-is. Once we fixed that, this might change and open up a whole new set of use-cases and applications. But the main target here is to secure sync in these private wide-area-networks where unicast PTP is in use today.

> Regards,
> Ulrich

Regards,
   Heiko




--
Heiko Gerstung
Managing Director

MEINBERG® Funkuhren GmbH & Co. KG
Lange Wand 9
D-31812 Bad Pyrmont, Germany
Phone: [phone]
Fax: [phone]

Amtsgericht Hannover 17HRA 100322
Geschäftsführer/Management: Günter Meinberg, Werner Meinberg, Andre Hartmann, Heiko Gerstung

Email:
[e-mail]<mailto:[e-mail]>
Web:
Deutsch https://www.meinberg.de
English https://www.meinbergglobal.com

Do not miss our Time Synchronization Blog:
https://blog.meinbergglobal.com

Connect via LinkedIn:
https://www.linkedin.com/in/heikogerstung



Am 07.06.21, 09:22 schrieb "ntp im Auftrag von Ulrich Windl" <[e-mail]<mailto:[e-mail]> im Auftrag von [e-mail]<mailto:[e-mail]>>:


    >
    > Doug
    >
    > From: ntp <ntp‑[e-mail]<mailto:ntp‑[e-mail]>> on behalf of Miroslav Lichvar
    > <[e-mail]<mailto:[e-mail]>>
    > Date: Thursday, June 3, 2021 at 4:03 AM
    > To: Dieter Sibold <[e-mail]<mailto:[e-mail]>>
    > Cc: Heiko Gerstung <heiko.gerstung=[e-mail]<mailto:heiko.gerstung=[e-mail]>>, NTP WG
    > <[e-mail]<mailto:[e-mail]>>
    > Subject: Re: [Ntp] NTS4UPTP draft
    > On Wed, Jun 02, 2021 at 11:40:49PM +0200, Dieter Sibold wrote:
    >> In the past PTP is applied mainly in local networks but today it is going
    to
    >> be applied across Internet connection also.
    >
    > Just to clarify, do you mean that people are now using PTP to
    > synchronize clocks over Internet, or that the servers are
    > accessible from Internet and that's why they need to be secured?
    >
    > The former wouldn't make sense to me as PTP relies on hardware support
    > in routers/switches, which is generally missing on Internet.
    >
    > ‑‑
    > Miroslav Lichvar
    >
    > _______________________________________________
    > ntp mailing list
    > [e-mail]<mailto:[e-mail]>
    > https://www.ietf.org/mailman/listinfo/ntp



    _______________________________________________
    ntp mailing list
    [e-mail]<mailto:[e-mail]>
    https://www.ietf.org/mailman/listinfo/ntp