Meraki

Community

About Israelgq

Re: Meraki MS NTP server - exit-relay.tor.world

by in Switching
‎Mar 26 2020 12:28 PM
1 Kudo
‎Mar 26 2020 12:28 PM
1 Kudo
I found what the issue is. As you guys mentioned, Meraki uses ntp.pool.org however, these particular IPs host some ntp.pool.org sub-domains as well as, other domains such as exit-relay.tor.world and because of it, checkpoint firewall is relating the IPs with that domain instead.   As you said, it should not be nothing to be worried about, it is normal and expected behavior.   Thanks ... View more

Re: Meraki MS NTP server - exit-relay.tor.world

by in Switching
‎Mar 26 2020 10:54 AM
‎Mar 26 2020 10:54 AM
Switches are running in L2 and the source IP is the switch management IP address ... View more

Re: Meraki MS NTP server - exit-relay.tor.world

by in Switching
‎Mar 26 2020 10:05 AM
‎Mar 26 2020 10:05 AM
I just ran a test and this particular domain exit-relay.tor.world does not respond to NTP request. What is concerning to my customer is not the NTP requests per se, it is this particular fqdn where the requests are being sent. As it looks like to be related as TOR exit point even when its reputation and risk scores are low. ... View more

Re: Meraki MS NTP server - exit-relay.tor.world

by in Switching
‎Mar 26 2020 9:40 AM
‎Mar 26 2020 9:40 AM
Hi Brandon,   I have the firewall logs where I can see clearly the request being originated from the Meraki SW to the IPs/domains mentioned.     ... View more

Meraki MS NTP server - exit-relay.tor.world

by in Switching
‎Mar 26 2020 8:21 AM
‎Mar 26 2020 8:21 AM
Hi there,   I have a customer who is getting logs on its Internet Edge firewall regarding NTP requests made from his Meraki switches. The weird thing is that some NTP requests are to the following domains/IPs between others (cloudfare i.e)   exit-relay.tor.world (178.162.211.152) support.russianbridesnetwork.com (95.216.218.15) formularfetischisten.de (85.10.240.253) pauseq4vntp2.datamossa.io (103.126.53.123)   Which don´t seem to be related with an NTP service, specially the exit-relay.tor.world domain. He is very concerned about these requests.   Can you please help me to understand why Meraki switches are sending NTP requests to those domains? Is there any list with specific time server that meraki uses?   I opened a case with Meraki support but their answer so far is that "it is expected" however, I can not come back with my customer with that answer specially due the domains are being requested.   Looking forward for some help ... View more
My Top Kudoed Posts
© 2025 Cisco Systems, Inc.