NTP Time Servers

Configure the Router or Switch to Operate in Client Mode

To configure the local router or switch to operate in client mode, include the server statement and other optional statements at the [edit system ntp] hierarchy level:

[edit system ntp]
server address <key key-number> <version value> <prefer>; 
authentication-key key-number type type value password;
trusted-key[key-numbers];

Specify the address of the system acting as the time server. You must specify an address, not a hostname.

To include an authentication key in all messages sent to the time server, include the key option. The key corresponds to the key number you specify in the authentication-key statement, as described in .

By default, the router or switch sends NTP version 4 packets to the time server. To set the NTP version level to 1, 2, or 3, include the version option.

If you configure more than one time server, you can mark one server preferred by including the prefer option.

The following example shows how to configure the router or switch to operate in client mode:

[edit system ntp]
authentication-key 1 type md5 value "$ABC123";
server 10.1.1.1 key 1 prefer;
trusted-key 1;

Configure the Router or Switch to Operate in Symmetric Active Mode

To configure the local router or switch to operate in symmetric active mode, include the peer statement at the [edit system ntp] hierarchy level:

[edit system ntp]
peer address <key key-number> <version value> <prefer>; 

Specify the address of the remote system. You must specify an address, not a hostname.

To include an authentication key in all messages sent to the remote system, include the key option. The key corresponds to the key number you specify in the authentication-key statement.

By default, the router or switch sends NTP version 4 packets to the remote system. To set the NTP version level to 1, 2 or 3, include the version option.

If you configure more than one remote system, you can mark one system preferred by including the prefer option:

 peer address <key key-number> <version value> prefer;

Configure the Router or Switch to Operate in Broadcast Mode

To configure the local router or switch to operate in broadcast mode, include the broadcast statement at the [edit system ntp] hierarchy level:

[edit system ntp]
broadcast address <key key-number> <version value> <ttl value>; 

Specify the broadcast address on one of the local networks or a multicast address assigned to NTP. You must specify an address, not a hostname. If the multicast address is used, it must be 224.0.1.1. Multicast protocols PIM and IGMP should be enabled on the NTP client facing interfaces in order to facilitate the device to transmit NTP packets over multicast address 224.0.1.1. Run the following commands to do so:

set protocols igmp interface <interface_name> static group 224.0.1.1
set protocols pim rp local address <interface_ip>
set protocols pim interface <interface_name> mode sparse-dense

To include an authentication key in all messages sent to the remote system, include the key option. The key corresponds to the key number you specify in the authentication-key statement.

By default, the router or switch sends NTP version 4 packets to the remote system. To set the NTP version level to 1, 2, or 3, include the version option.

Configure the Router or Switch to Operate in Server Mode

In server mode, the router or switch acts as an NTP server for clients when the clients are configured appropriately. The only prerequisite for “ server mode” is that the router or switch must be receiving time from another NTP peer or server. No other configuration is necessary on the router or switch.

When configuring the NTP service in the management VRF (mgmt_junos), you must configure at least one IP address on a physical or logical interface within the default routing instance and ensure that this interface is up in order for the NTP service to work with the mgmt_junos VRF.

To configure the local router or switch to operate as an NTP server, include the following statements at the [edit system ntp] hierarchy level:

[edit system ntp]
authentication-key  key-number type type value password;
server address <key key-number> <version value> <prefer>; 
trusted-key [key-numbers];

Specify the address of the system acting as the time server. You must specify an address, not a hostname.

To include an authentication key in all messages sent to the time server, include the key option. The key corresponds to the key number you specify in the authentication-key statement.

By default, the router or switch sends NTP version 4 packets to the time server. To set the NTP version level to 1,or 2, or 3, include the version option.

If you configure more than one time server, you can mark one server preferred by including the prefer option.

The following example shows how to configure the router or switch to operate in server mode:

[edit system ntp]
authentication-key 1 type md5 value "$ABC123";
server 192.168.27.46 prefer;
trusted-key 1;

Starting unos OS Evolved release version 24.2R1, the following options are added to configure the NTS feature:

[edit system ntp]
 nts 
{
       local-certificate <certificate-id of local certificate>;
	trusted-ca (trusted-ca-group <trusted ca-group name> | trusted-ca-profile <ca-profile name>);
}

[edit system ntp server <server>]
 nts remote-identity 
{
 	hostname <FQDN of server>;
 	distinguished-name (container <container-string> | wildcard <wild-card string>);
}