6

I have an NTP configured through out our in a hierarchy. 100% reliable with regards to providing time for Cisco devices. At one of our sites we allow cameras, servers, and workstations to utilize our Catalyst 4500s as their time source. Access layer switches have no problems drawing time from the 4500s. The cameras and servers however fail. The servers may turn out to be user error in configuring the Windows time service. A debug on the 4500s does show that the NTP process receives the request from the cameras, but the NTP process does not respond. My NTP configuration on the core is:

access-list 23 permit 10.1X.2X.1
access-list 24 permit 10.1X.0.0 0.0.255.255 log
access-list 24 permit 10.2X.0.0 0.0.255.255 log
access-list 24 deny   any log

ntp logging
ntp authentication-key 30 md5 XXXX 7
ntp authenticate
ntp trusted-key 3X
ntp source Vlan1
ntp access-group peer 23
ntp access-group serve 24
ntp update-calendar
ntp server 10.1X.2X.1 key 30

Camera requests (results in no reply)

Feb 26 13:20:34.327 pst: NTP recv pkt on v4 socket, pak = 0x83195238.
Feb 26 13:20:34.327 pst: NTP message received from 10.2X.0.215 on interface 'Vlan1' (10.X.X.2):
Feb 26 13:20:34.327 pst: 
 NTP Header:
   Leap = 11, Version = 4, Mode = 3,
   Stratum = 0,
   Poll Interval = 4,
   Precision = -6,
   Root Delay = 1.0,
   Root Dispersion = 1.0,
   refid = 0.0.0.0,
   Last update reftime = 0.0,
   Originated time = 0.0,
   Received time = 0.0,
   Transmit time = 3602438434.1847076455.
 Hexadecimal equivalent (length = 48):
   0000: E3 00 04 FA 00 01 00 00
   0008: 00 01 00 00 00 00 00 00
   0010: 00 00 00 00 00 00 00 00
   0018: 00 00 00 00 00 00 00 00
   0020: 00 00 00 00 00 00 00 00
   0028: D6 B8 D9 22 6E 18 26 67

The Cat 4500 is running NTPv4 

Switch#show ntp associations detail 
10.1X.2X.1 configured, ipv4, authenticated, our_master, sane, valid, stratum 3 
ref ID 10.X.X.X, time D6BB4F9D.6151EB70 (10:10:37.380 pst Fri Feb 28 2014)
our mode client, peer mode server, our poll intvl 1024, peer poll intvl 1024
root delay 61.55 msec, root disp 38.98, reach 377, sync dist 87.17
delay 1.78 msec, offset 1.7177 msec, dispersion 1.14, jitter 1.45 msec
precision 2**24, version 4
assoc id 13634, assoc name 10.1X.2X.1
assoc in packets 7068, assoc out packets 7069, assoc error packets 0
org time 00000000.00000000 (16:00:00.000 pst Wed Dec 31 1899)
rec time D6BB5203.C83AE4D7 (10:20:51.782 pst Fri Feb 28 2014)
xmt time D6BB5203.C83AE4D7 (10:20:51.782 pst Fri Feb 28 2014)
filtdelay =     4.85    4.86    3.85    3.83    3.85    1.83    3.83    1.78
filtoffset =   -0.30   -0.32    0.22    0.62    0.38    1.88    0.57    1.71
filterror =     0.97    1.00    1.03    1.06    1.09    1.12    1.15    1.18
minpoll = 6, maxpoll = 10
Improve this question
5
  • Is there any way you can post the configurations of your Camera and Servers?
    – Ryan Foley
    Mar 1, 2014 at 9:25
  • 2
    FYI, windows speaks SNTP by default unless you load something like the Meinberg NTP on your windows systems; SNTP isn't compliant with the NTP RFC, and Cisco rejects those packets by default (although you can hack around it). It's more work, but I'd go with all windows clients sync with w32time to your Domain Controller, and then put Meinberg on the DC so it talks correctly to your routers. Finally, add clock calendar-valid in your config (assuming this platform supports it).
    – Mike Pennington
    Mar 1, 2014 at 9:48
  • @MikePennington That sounds like a pretty solid answer to me...
    – Ryan Foley
    Mar 1, 2014 at 17:44
  • @fizzle, thank you but it doesn't directly solve the problem with his cameras. Unless he changed the scope of the question, I would rather keep it as a comment for now
    – Mike Pennington
    Mar 1, 2014 at 17:49
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Jan 4, 2021 at 23:30

2 Answers 2

Reset to default
5

Your 4500 is most likely running NTP v3. This is the default on many recent IOS versions.

As shown in your debug

Leap = 11, Version = 4, Mode = 3

your server is looking for NTP v4.

Improve this answer
3
  • I verified the 4500s are running V4. They are communicating upstream via v4. The access layer switches are running v3.
    – henklu
    Feb 28, 2014 at 18:56
  • 1
    Could you do a "debug ntp authentication"? Maybe an issue there.
    – Mike Marotta
    Feb 28, 2014 at 19:39
  • 1
    Great suggestion. Unfortunately this IOS doesn't support the command. From my understanding authentication only really causes failures if the client is looking for it and the key is wrong or not there.
    – henklu
    Feb 28, 2014 at 23:56
2

Stumbled across this old thread as a "related post" to something I was viewing.

Windows Servers' (S)NTP client needs to be configured to run in "client mode" when querying Cisco IOS (and probably some other NTP servers, too). IOS' NTP server is picky as to whom it wants to peer with and from whom it accepts client-mode requests. By default, Windows Server's W32time wants to peer ("symmetric active mode").

https://support.microsoft.com/en-ca/help/875424/time-synchronization-may-not-succeed-when-you-try-to-synchronize-with

That's still valid, even for Windows Server 2016, btw - I came across this only a few weeks back on a completely fresh Windows Domain/ActiveDirectory setup.

In short: Append ,0x8 to the given NTP server's hostname or IP address, as configured on the Windows 2016 server in Regedit, GPO, command line...

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.