ntp

Configure key (key ID, key type, and key value) to authenticate NTP packets with the devices (servers and clients). The authentication key has two fields:

• type—When authentication is specified, the key identifier (key ID) followed by the message digest is appended to the NTP packet header. The supported message digest formats are md5, sha1, sha256.

  Note:

  EX4600 does not support SHA256 authentication for NTP and supports MD5 only.

• value—If the key value is available in ASCII format and without special characters, it can be entered directly. If the key value contains special characters or is available in hex format, consider the following:

  For specifying the keys in hex format, prepend a "\x" for each two characters. For hex key example, af60112f...39af4ced, set system ntp authentication-key <ID> value "\xaf\x60\x11\x2f\....\x39\xaf\x4c\xed".

  If the key contains one of the characters from (null) 0x00, (space) 0x20, " 0x22, & 0x26, ( 0x28 ) 0x29 prepend a "\\x" . For example, \\x22.

• Range: 1 to 65534

Configure the server that NTP queries when the device boots to determine the local date and time.

When you boot the device, it issues an ntpdate request, which polls a network server to determine the local date and time. You must configure an NTP boot server that the device uses to determine the time when the device boots. Otherwise, NTP cannot synchronize to a time server if the server time significantly differs from the local device’s time.

If you configure an NTP boot server, then when the device boots, it immediately synchronizes with the boot server even if the NTP process is explicitly disabled or if the time difference between the client and the boot server exceeds the threshold value of 1000 seconds.

• Values: Configure one of the following:

  • address—IP address of an NTP boot server.

  • hostname—Hostname of an NTP boot server. If you configure a hostname instead of an IP address, the ntpdate request resolves the hostname to an IP address when the device boots up.

Configure the device to operate in broadcast mode with the remote system at the specified address. In this mode, the device sends periodic broadcast messages to a client population at the specified broadcast or multicast address. Normally, you include this statement only when the device is operating as a transmitter.

Configure the local device to listen for broadcast messages on the local network to discover other servers on the same subnet. To avoid accidental or malicious disruption in this mode, both the local and remote systems must use authentication and the same trusted key and key identifier.

Configure the poll interval range.

• Range: 0 through 3

Configure the local device to listen for multicast messages on the local network. To avoid accidental or malicious disruption in this mode, both the local and remote systems must use authentication and the same trusted key and key identifier.

• Syntax: <address>—(Optional) Specify one or more IP addresses. If you specify addresses, the device joins those multicast groups.

• Default: 224.0.1.1

Configure the Network Time Security (NTS) features for NTP on your device.

Configure the local device to operate in symmetric active mode with the remote system at the specified address. In this mode, the local device and the remote system can synchronize with each other. This configuration is useful in a network in which either the local device or the remote system might be a better source of time.

Restrict packets from hosts (including remote time servers) and subnets.

• Syntax:

  • address—Specify the IP address for a host or network.

  • mask network-mask—Specify the network mask for a host or network.

  • noquery—Deny ntpq and ntpdc queries from hosts and subnets. These queries can be used in amplification attacks.

Configure the local device to operate in client mode with the remote system at the specified address. In this mode, the device can be synchronized with the remote system, but the remote system can never be synchronized with the device.

If the NTP client time drifts so that the difference in time from the NTP server exceeds 128 milliseconds, the client is automatically stepped back into synchronization. If the offset between the NTP client and server exceeds the 1000-second threshold, the client still synchronizes with the server, but it also generates a system log message noting that the threshold was exceeded.

A valid IP address configured on one of the device’s interfaces to be used as the source address for messages sent to the NTP server, and optionally, the routing instance in which the source address is configured.

• Default: The primary address of the interface

Configure the maximum threshold in seconds allowed for NTP adjustment and specify the mode for NTP abnormal adjustment.

• Range: 1 through 600 seconds

• Values: Configure one of the following:

  • accept—Enable log mode for abnormal NTP adjustment.

  • reject—Enable reject mode for abnormal NTP adjustment.

Configure one or more keys you are allowed to use to authenticate other time servers, when you configure the local device to synchronize its time with other systems on the network. Each key can be any 32-bit unsigned integer except 0. The key corresponds to the key number you specify in the authentication-key statement.

By default, network time synchronization is unauthenticated. The device synchronizes to whatever system appears to have the most accurate time. We strongly encourage you to configure authentication of network time services.