Usage Guidelines

The access group options are scanned in the following order from least restrictive to most restrictive:

1. peer—Allows time requests and NTP control queries and allows the router to synchronize itself to a system whose address passes the access list criteria.

2. serve—Allows time requests and NTP control queries, but does not allow the router to synchronize itself to a system whose address passes the access list criteria.

3. serve-only—Allows only time requests from a system whose address passes the access list criteria.

4. query-only—Allows only NTP control queries from a system whose address passes the access list criteria.

Access is granted for the first match that is found. If no access groups are specified, all access is granted to all sources. If any access groups are specified, only the specified access is granted. This facility provides minimal security for the time services of the system. However, it can be circumvented by a determined programmer. If tighter security is desired, use the NTP authentication facility.

If you use the access-group command in a VRF-specific NTP configuration mode, the command is applied to the specific VRF. If you are not in a VRF-specific NTP configuration mode, the command is applied to the default VRF unless you use the vrf vrf-name keyword and argument to specify a VRF.

Usage Guidelines

This feature is enabled by default to prevent an exploitable condition when passive , broadcast client or multicast client is configured.

If the system has been configured with the broadcast client or multicast client command in NTP configuration mode, and when the system receives an incoming symmetric active NTP packet, or if the system receives a broadcast or multicast mode NTP packet, it can set up an ephemeral peer association in order to synchronize with the sender. The system will then synchronize to the peer when a symmetric active, broadcast, or multicast NTP packet is received and the packet carries one of the authentication keys specified in the trusted-key command.

Even though NTP authentication is enabled by default, it does not force the authentication of peer associations that are created using the server and peer commands in NTP configuration mode. It only enforces authentication when remote systems attempt to create new ephemeral associations.

Use the no authenticate command to allow synchronizing with unauthenticated and unconfigured network peers.

Usage Guidelines

Use the authentication-key command to define authentication keys for use with trusted NTP time sources.

Note	When this command is written to NVRAM, the key is encrypted so that it is not displayed when the configuration is displayed.

Usage Guidelines

Use the broadcast command to create an NTP broadcast server on an NTP interface to send NTP broadcast packets.

Use the broadcast client command to set a specific interface to receive NTP broadcast packets.

Usage Guidelines

Use the broadcast client command to configure and create an NTP broadcast client and to associate the client with an interface to receive and handle NTP broadcast packets. If no NTP client has been created for an interface, the received NTP broadcast packets are dropped. Use this command to allow the system to listen to broadcast packets on an interface-by-interface basis.

To prevent synchronization with unauthorized systems, whenever this command is specified, authentication must be enabled using the authenticate (NTP) command or access must be restricted to authorized systems using the access-group (NTP) command. See the documentation of the respective commands for more information.

Usage Guidelines

Use the broadcastdelay command to change the default round-trip delay time on a networking device that is configured as a broadcast client.

Usage Guidelines

Use the interface command to place the router in NTP interface configuration mode, from which NTP broadcast and multicast servers and clients can be configured. By default, after the NTP process is started, NTP features become available for all interfaces. To exit NTP interface configuration mode, use the exit command.

If you use the interface command in a VRF-specific NTP configuration mode, the command is applied to the specific VRF. If you are not in a VRF-specific NTP configuration mode, the command is applied to the default VRF unless you use the vrf vrf-name keyword and argument to specify a VRF.

By default, NTP is enabled on every interface. To disable NTP on a specific interface, use the interface command with the disable keyword. To reenable NTP on an interface, use the no form of the interface command with the disable keyword.

Usage Guidelines

NTP uses the concept of a “stratum” to describe how many NTP “hops” away a machine is from an authoritative time source. A stratum 1 time server has a radio or atomic clock attached directly. A stratum  2 time server receives its time through NTP from a stratum 1 time server, a stratum 3 from a stratum 2, and so on.

Caution

Use the master command with extreme caution. It is easy to override other valid time sources using this command, especially if a low-stratum number is configured. Configuring multiple machines in the same network with the master command can lead to instability in time-keeping if the machines do not agree on the time.

The networking device is normally synchronized, directly or indirectly, with an external system that has a clock. Cisco IOS XR software does not support directly attached radio or atomic clocks. The master command should be used only when there is a temporary disruption in a reliable time service. It should not be employed as an alternative source by itself in the absence of a real-time service.

If the system has the master command configured and it cannot reach any clock that has a lower stratum number, the system claims to be synchronized at the configured stratum number. Other systems synchronize with it through NTP.

Note	The system clock must have been manually set from some source before the master command has an effect. This precaution protects against the distribution of erroneous time after the system is restarted.

Usage Guidelines

PTP must be enabled on the router before this command can be used. If PTP is not enabled, you receive an error message similar to the following when you try to commit the configuration:

RP/0/RP0/CPU0:router(config)# ntp master primary-reference-clock
RP/0/RP0/CPU0:router(config)# commit

% Failed to commit one or more configuration items. Please issue 
'show configuration failed' from this session to view the errors

RP/0/RP0/CPU0:router(config)# show configuration failed
[:::]
ntp
 master primary-reference-clock
!!% 'ip-ntp' detected the 'fatal' condition 'PTP is not supported on this platform'
!
end
  

To verify that PTP is used as the reference clock, use the show ntp association command.

RP/0/RP0/CPU0:router# show ntp association   

  address           ref clock        st   when  poll reach  delay  offset  disp
*~127.127.45.1     .PTP.             0    54    64   377    0.00   6.533   1.905

* sys_peer, # selected, + candidate, - outlayer, x falseticker, ~ configured

Usage Guidelines

Use the max-associations command to specify the maximum number of associations for an NTP server.

Usage Guidelines

Use the multicast client command to configure an NTP interface to receive multicast packets that are sent to an IPv4 or IPv6 multicast group IP address. If you do not specify an IP address, the interface is configured to receive multicast packets sent to the IPv4 multicast group address 224.0.1.1. You can configure multiple multicast groups on the same interface.

To prevent synchronization with unauthorized systems, whenever this command is specified, authentication must be enabled using the authenticate (NTP) command or access must be restricted to authorized systems using the access-group (NTP) command. See the documentation of the respective commands for more information.

Usage Guidelines

No specific guidelines impact the use of this command.

Usage Guidelines

NTP configuration commands can also be run from global configuration mode by preceding the command string with the ntp keyword. From NTP configuration mode, the following NTP configuration commands are available:

RP/0/RP0/CPU0:router(config-ntp)# ?
  
    access-group        Control NTP access
    authenticate        Authenticate time sources
    authentication-key  Authentication key for trusted time sources
    broadcastdelay      Estimated round-trip delay
    commit              Commit the configuration changes to running
    default             Set a command to its defaults
    describe            Describe a command without taking real actions
    do                  Run an exec command
    exit                Exit from this submode
    interface           Configure NTP on an interface
    master              Act as NTP master clock
    max-associations    Set maximum number of associations
    no                  Negate a command or set its defaults
    peer                Configure NTP peer
    port                Enable NTP port
    server              Configure NTP server
    show                Show contents of configuration
    source              Configure interface for source address
    trusted-key         Key numbers for trusted time sources
    update-calendar     Periodically update calendar with NTP time
    

Use the ntp command with the vrf vrf-name keyword and argument to enter an NTP configuration mode specific to the specified VRF.

Usage Guidelines

No specific guidelines impact the use of this command.

Usage Guidelines

Use the ntp reset drift command to set the loopfilter state to NSET (never set) and reset the drift. Resetting the loopfilter state and drift enables the router to relearn the frequency of the NTP server clock. This is necessary if there is a synchronization error caused by a large frequency error. This can arise, for example, if the router switches from synchronizing with one NTP server to synchronizing with another NTP server with a different frequency.

Usage Guidelines

Use the peer command to allow this machine to synchronize with the peer, or conversely.

Caution

Although using the prefer keyword can help reduce the switching among peers, you should avoid using the keyword because it interferes with the source selection mechanism of NTP and can result in a degradation in performance.

The value for the minpoll keyword must be less than or equal to the value for the maxpoll keyword. If this is not the case, the system issues an error message.

To provide peer-level service (as opposed to client/server-level service), it may be necessary to explicitly specify the NTP version for the peer if it is not version 4.

If you use the peer command in a VRF-specific NTP configuration mode, the command is applied to the specific VRF. If you are not in a VRF-specific NTP configuration mode, the command is applied to the default VRF unless you use the vrf vrf-name keyword and argument to specify a VRF.

Note

To change the configuration of a specific IP address from peer to server or from server to peer, use the no form of the peer or server command to remove the current configuration before you perform the new configuration. If you do not remove the old configuration before performing the new configuration, the new configuration does not overwrite the old configuration.

Usage Guidelines

The value for the minpoll keyword must be less than or equal to the value for the maxpoll keyword. If this is not the case, the system issues an error message.

Using the prefer keyword reduces switching back and forth among servers.

If you use the server command in a VRF-specific NTP configuration mode, the command is applied to the specific VRF. If you are not in a VRF-specific NTP configuration mode, the command is applied to the default VRF unless you use the vrf vrf-name keyword and argument to specify a VRF.

Note

To change the configuration of a specific IP address from peer to server or from server to peer, use the no form of the peer or server command to remove the current configuration before you perform the new configuration. If you do not remove the old configuration before performing the new configuration, the new configuration does not overwrite the old configuration.

Usage Guidelines

The time format of the show calendar output depends on the time format set using the clock timezone command.

Usage Guidelines

Output for the show ntp associations command is displayed only if NTP is configured on the router.

Usage Guidelines

No specific guidelines impact the use of this command.

Usage Guidelines

Use the source command to use a particular source IP address for all NTP packets. The address is taken from the named interface. This command is useful if the address on an interface cannot be used as the destination for reply packets. If the source keyword has been configured with the server (NTP) or peer (NTP) command, that value overrides the global value.

Use the source command in a VRF-specific NTP configuration mode or use the vrf vrf-name keyword and argument to configure the source address for a specific nondefault VRF. Otherwise, the configuration is applied to the default VRF.

Usage Guidelines

If authentication is enabled, use the trusted-key command to define one or more key numbers (corresponding to the keys defined with the authentication-key [NTP] command) that a NTP system must provide in its NTP packets for this system to synchronize to it. Because the other system must know the correct authentication key, this precaution provides protection against accidentally synchronizing the system to a system that is not trusted.

Usage Guidelines

Your router has a calendar that is separate from the software clock. This calendar runs continuously, even if the router is powered off or rebooted.

If a router is synchronized to an outside time source through NTP, it is a good idea to update the router’s calendar with the time learned from NTP. Otherwise, the calendar may gradually lose or gain time.

After you configure the update-calendar command, NTP updates the calendar with the software clock every hour.