With NTP, authentication is controlled by the requester. An NTP server cannot force authentication on NTP clients; it is happy to send out unauthenticated NTP to clients. A client must request NTP authentication, and it will reject unauthenticated NTP if it has requested authentication.
The ntp master
command tells a device to be the master clock when an NTP source is not available. This is an oft misunderstood command that is rarely necessary.
The ntp authentication-key
command merely sets up what the authentication key is. Notice that you set up the key on the server. If that command required authentication, then the NTP server would also require the authentication of its NTP server (NTP is layered).
The ntp authenticate
command says that the NTP client will require authentication from its NTP server.
The ntp trusted-key
command tells the client which of the configured keys to use.
The ntp server
command tells the client which NTP server to use.
Edit based on your comments:
I originally answered your question:
What does ntp authenticate
do different from ntp trusted-key 22
?
In what cases would I have one command applied but not the other?
but that doesn't seem to really be your question.
If you are going to configure multiple NTP servers with different authentication keys, it will probably look something like this:
NTP Server 1:
R1(config)#ntp source Loopback1
R1(config)#ntp authentication-key 1 md5 SECRET-NTP-KEY-1
NTP Server 2:
R2(config)#ntp source Loopback1
R2(config)#ntp authentication-key 1 md5 SECRET-NTP-KEY-2
NTP Server 3:
R3(config)#ntp source Loopback1
R3(config)#ntp authentication-key 1 md5 SECRET-NTP-KEY-3
NTP Client:
R4(config)#ntp authenticate
R4(config)#ntp authentication-key 1 md5 SECRET-NTP-KEY-1
R4(config)#ntp authentication-key 2 md5 SECRET-NTP-KEY-2
R4(config)#ntp authentication-key 3 md5 SECRET-NTP-KEY-3
R4(config)#ntp server 10.11.12.1 key 1
R4(config)#ntp server 10.11.12.2 key 2
R4(config)#ntp server 10.11.12.3 key 3
If you are going to configure multiple NTP servers with the same authentication keys, it will probably look something like this:
NTP Server 1:
R1(config)#ntp source Loopback1
R1(config)#ntp authentication-key 1 md5 SECRET-NTP-KEY
NTP Server 2:
R2(config)#ntp source Loopback1
R2(config)#ntp authentication-key 1 md5 SECRET-NTP-KEY
NTP Server 3:
R3(config)#ntp source Loopback1
R3(config)#ntp authentication-key 1 md5 SECRET-NTP-KEY
NTP Client:
R4(config)#ntp source Loopback1
R4(config)#ntp authenticate
R4(config)#ntp authentication-key 1 md5 SECRET-NTP-KEY
R4(config)#ntp trusted-key 1
R4(config)#ntp server 10.11.12.1
R4(config)#ntp server 10.11.12.2
R4(config)#ntp server 10.11.12.3
Having the NTP source based on the loopback is a good idea. If one link goes down, NTP can still be updated if the traffic can get to and from the server via a different path.
The ntp trusted-key <key number
command will be used for commands on which you don't use the optional key <key number>
for any of the ntp server <server address> or
ntp peer ` commands.
The ntp source <interface>
command will be used for commands on which you don't use the optional source <interface>
for any of the ntp server <server address> or
ntp peer ` commands.
Edit 2:
The NTP configuration from lab tests (not performed by me, but by a group which tests all network hardware/software features) for routers with IOS 15.x that passed (the password and addresses were changed for protection):
ntp authentication-key 1 md5 123456789 7
ntp authenticate
ntp trusted-key 1
ntp source Loopback0
ntp update-calendar
ntp server 10.11.12.13
ntp server 10.12.13.14 prefer
Notice that the optional key <key number>
is not used on the ntp server <server address>
commands because the servers are configured with the same authentication key.