I have a Cisco SG350-10P. I am trying to connect it to my SNTP server. It requires an MD5 authentication key is required to connect and it is a 16 character password. But my switch will only take 8 character keys. Unless I am using the wrong command.

This is what I am using:

switch(config)#sntp authentication-key 1 md5
WORD<1-8>        key value

So how do I use my 16 character key if it only lets me use 8?


You have it backwards. NTP servers cannot force a client to use authentication. It is the client that demands authentication from the server.

The server is happy to serve up NTP to any client that asks, but the client may want to make sure that the server is authentic, so it can demand the authentication. If you simply do not configure authentication on the switch it can still get NTP from the NTP server.

Basically, the NTP client is validating the NTP source (server). The NTP server doesn't care who asks for the time.

This messes with people's heads because it is backwards from most server authentications.

  • Thats strange because my S200 has an MD5 key authentication tab where it shows the authentication tied to the IP address it is serving from. Are you sure this is correct?
    – JukEboX
    Apr 15 at 11:41
  • 1
    Yes, it is correct. What you have is the server being able to respond to a client's authentication request, and it needs that information to be able to send the authentication. The client will compare what the server sends to what it expects. All it takes is a simple search to find how NTP really works with authentication. The time is not proprietary, so it does not need protection on the server side, it is the client that must make sure the time it gets is from a trusted source.
    – Ron Maupin
    Apr 15 at 12:20
  • 1
    @JukEboX, RFC 1305, Network Time Protocol (Version 3): "Authentication Enabled Bit (peer.authenable): This is a bit indicating that the association is to operate in the authenticated mode. For configured peers this bit is determined from the startup environment. For non-configured peers, this bit is set to one if an arriving message includes the authenticator and set to zero otherwise." The client initiates the connection, so it either asks for authentication or not.
    – Ron Maupin
    Apr 15 at 12:25
  • so I understand a bit better. The Switch sends the MD5 to the server and the server sets what it expects. So you can copy what it expects and code it to the switch so it can authenticate.
    – JukEboX
    Apr 15 at 12:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.