2

A typical Authenticated NTP configuration looks like this:

NTP Server

R1(config)# ntp master
R1(config)# ntp authentication-key 22 md5 SECRET-NTP-KEY

NTP Client:

R2(config)# ntp authenticate
R2(config)# ntp authentication-key 22 md5 SECRET-NTP-KEY
R2(config)# ntp trusted-key 22
R2(config)# ntp server 12.0.0.1 key 22

I'm confused about the individual purposes of each command in the Client configuration.

What does ntp authenticate do different from ntp trusted-key 22? In what cases would I have one command applied but not the other?

I understand ntp authenticate turns on NTP authentication, and ntp authentcation-key ## ... configures a specific authentication key. Then ntp server x.x.x.x key ## associates a particular key to a particular NTP Server. But why would it be necessary to then add an additional command to indicate you trust a particular authentication key (ntp trusted-key ...)?

Wouldn't simply having the key configured be sufficient to indicate that it is trusted?

Improve this question
1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 12 '17 at 18:54
2

With NTP, authentication is controlled by the requester. An NTP server cannot force authentication on NTP clients; it is happy to send out unauthenticated NTP to clients. A client must request NTP authentication, and it will reject unauthenticated NTP if it has requested authentication.

The ntp master command tells a device to be the master clock when an NTP source is not available. This is an oft misunderstood command that is rarely necessary.

The ntp authentication-key command merely sets up what the authentication key is. Notice that you set up the key on the server. If that command required authentication, then the NTP server would also require the authentication of its NTP server (NTP is layered).

The ntp authenticate command says that the NTP client will require authentication from its NTP server.

The ntp trusted-key command tells the client which of the configured keys to use.

The ntp server command tells the client which NTP server to use.

Edit based on your comments:

I originally answered your question:

What does ntp authenticate do different from ntp trusted-key 22? In what cases would I have one command applied but not the other?

but that doesn't seem to really be your question.

If you are going to configure multiple NTP servers with different authentication keys, it will probably look something like this:

NTP Server 1:

R1(config)#ntp source Loopback1
R1(config)#ntp authentication-key 1 md5 SECRET-NTP-KEY-1

NTP Server 2:

R2(config)#ntp source Loopback1
R2(config)#ntp authentication-key 1 md5 SECRET-NTP-KEY-2

NTP Server 3:

R3(config)#ntp source Loopback1
R3(config)#ntp authentication-key 1 md5 SECRET-NTP-KEY-3

NTP Client:

R4(config)#ntp authenticate
R4(config)#ntp authentication-key 1 md5 SECRET-NTP-KEY-1
R4(config)#ntp authentication-key 2 md5 SECRET-NTP-KEY-2
R4(config)#ntp authentication-key 3 md5 SECRET-NTP-KEY-3
R4(config)#ntp server 10.11.12.1 key 1
R4(config)#ntp server 10.11.12.2 key 2
R4(config)#ntp server 10.11.12.3 key 3

If you are going to configure multiple NTP servers with the same authentication keys, it will probably look something like this:

NTP Server 1:

R1(config)#ntp source Loopback1
R1(config)#ntp authentication-key 1 md5 SECRET-NTP-KEY

NTP Server 2:

R2(config)#ntp source Loopback1
R2(config)#ntp authentication-key 1 md5 SECRET-NTP-KEY

NTP Server 3:

R3(config)#ntp source Loopback1
R3(config)#ntp authentication-key 1 md5 SECRET-NTP-KEY

NTP Client:

R4(config)#ntp source Loopback1
R4(config)#ntp authenticate
R4(config)#ntp authentication-key 1 md5 SECRET-NTP-KEY
R4(config)#ntp trusted-key 1
R4(config)#ntp server 10.11.12.1
R4(config)#ntp server 10.11.12.2
R4(config)#ntp server 10.11.12.3

Having the NTP source based on the loopback is a good idea. If one link goes down, NTP can still be updated if the traffic can get to and from the server via a different path.

The ntp trusted-key <key number command will be used for commands on which you don't use the optional key <key number> for any of the ntp server <server address> orntp peer ` commands.

The ntp source <interface> command will be used for commands on which you don't use the optional source <interface> for any of the ntp server <server address> orntp peer ` commands.

Edit 2:

The NTP configuration from lab tests (not performed by me, but by a group which tests all network hardware/software features) for routers with IOS 15.x that passed (the password and addresses were changed for protection):

ntp authentication-key 1 md5 123456789 7
ntp authenticate
ntp trusted-key 1
ntp source Loopback0
ntp update-calendar
ntp server 10.11.12.13
ntp server 10.12.13.14 prefer

Notice that the optional key <key number> is not used on the ntp server <server address> commands because the servers are configured with the same authentication key.

Improve this answer
13
  • Those aren't the commands I am confused about =)
    – Eddie
    Oct 31 '16 at 22:19
  • I appreciate your edit and second attempt, Ron, but I'm afraid you're still not answering my question. You say ntp trusted-key tells the client which configured key to use... if so, what does ntp server x.x.x.x key ## do?
    – Eddie
    Nov 1 '16 at 5:51
  • That is the key number to use. In your example, you are setting key 22, and you are telling it to use key 22. "If authentication is enabled, use this command to define one or more key numbers (corresponding to the keys defined with the ntp authentication-key command) that a peer NTP system must provide in its NTP packets, in order for this system to synchronize to it. This function provides protection against accidentally synchronizing the system to a system that is not trusted, because the other system must know the correct authentication key."
    – Ron Maupin ♦
    Nov 1 '16 at 14:34
  • That is what you said the ntp trusted-key command does.
    – Eddie
    Nov 1 '16 at 22:19
  • 1
    I think you are missing the part where the key number is optional on the ntp server <server address> and ntp peer <peer address> commands. You can define a lot of servers and/or peers, and you can use the ntp trusted-key to default to using the key for all, or you can use the optional key <key number> on the server and peer commands to specify individual or different keys to use for that server or peer. Personally, I wouldn't do it exactly the way you have in the question since I doubt there is an accurate clock attached to the server, and only one key on the client.
    – Ron Maupin ♦
    Nov 1 '16 at 22:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.