5

I am attempting to mitigate the issues surrounding bug report CSCum44673. According to the software release notes found here, I need to ensure that all of my routers are on IOS version 15.2(2) or newer. I also believe I need to include the statement "NTP allow mode control 3" on each of them.

So far I've verified that all of my routers are on newer software versions than that. What I am confused about is that many of them include the statement, "NTP allow mode control 0". I was under the impression per the above-linked software release that the only allowed values were from 3 - 15. I am also under the impression that a value of 3 is the default value.

What is the effect of using a 0 for the value?

Does this effectively mean that rate-limiting of NTP queries is turned off and that the router is still vulnerable to the potential DoS attack described in that bug report?

Is this command only useful if the router is set up as an NTP master ("NTP master 3" for example in the config)?

If it is only configured to synchronize with an NTP server located elsewhere ("NTP server x.x.x.x" in the config) does this command have any use?

Thanks for any clarification.

Improve this question
1
  • 2
    I can see you've posted on Cisco support forums. If you get an answer, please post it here and accept it, so that it can help others with the same issue.
    – user36472
    Feb 12, 2019 at 8:06

1 Answer 1

Reset to default
0

I was able to receive a response to this question in the Cisco community forums. See here: https://community.cisco.com/t5/network-management/effect-of-using-quot-ntp-allow-mode-control-0-quot/m-p/4032680#M132875

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.