NTP Sync issues between Palo Alto 3260 and Juniper MX10003

Question

I'm using a Microsemi S650 as the primary ntp server and a Juniper MX10003 as the secondary ntp server. I have the palo alto 3260 configured as follows:

    [edit deviceconfig system ntp-servers]
    ADMIN@PALOALTO-3260# show
    ntp-servers {
    primary-ntp-server {
    ntp-server-address fd40:a652:205:81::123;
     authentication-type {
      symmetric-key {
       algorithm {
       sha1 {
        authentication-key -AQ==A2yJAAeGbGTWyC8VvVcfpy26eRw=yrW8b/T3Jy7JBO39p2jxJJIKtK0Zmcf0hpKkBVObeE5yRXhcNw7d5m2kcRJwugdy;
      }
    }
       key-id 2;
  }
}
      }
secondary-ntp-server {
ntp-server-address fd40:a652:103:100::3;
authentication-type {
  symmetric-key {
    key-id 5;
    algorithm {
      sha1 {
        authentication-key -AQ==A2yJAAeGbGTWyC8VvVcfpy26eRw=yrW8b/T3Jy7JBO39p2jxJJIKtK0Zmcf0hpKkBVObeE5yRXhcNw7d5m2kcRJwugdy;
      }
    }
  }
}

} }

The MX10003 is configured as follows:

{master}[edit system ntp]
    ADMIN@MX1003-A3-RE0# show
    boot-server fd40:a652:205:81::123;
    authentication-key 3 type md5 value "$8$aes256-gcm$hmac-sha2-256$100$qj7VKJq6yp4$uleP/L5JAwqyxXz8Ycu+rg$0cSalY+VuOGOQWHUzeftUw$OV8LtMSs6Y/+i2Xnd5mx"; ## SECRET-DATA
    authentication-key 1 type md5 value "$8$aes256-gcm$hmac-sha2-256$100$1OUG+SJUcwQ$it9a/nJ5LtudKIvba0rAhw$IHYjs1Yf0568nez75hJP1g$TZmXQygdjl5OTD9yFZ/P"; ## SECRET-DATA
    authentication-key 5 type sha1 value "$8$aes256-gcm$hmac-sha2-256$100$lPz+7VuPMAM$9cfIRszWmHUTvHX7FO9Q9g$M7RbVvZCZVw4rY82p5f+3g$MfkbgtQDrDq26voT21BBAWlcbketGALnzM2RL8jJBLwE45LvpN0ahw"; ## SECRET-DATA
    server fd40:a652:205:81::123 key 1 prefer; ## SECRET-DATA
    server fd40:a652:103:100::3 key 5 prefer; ## SECRET-DATA
    trusted-key [ 1 3 5 ];
    source-address fd40:a652:103:100::3;

*NOTE: the MX10003's address is the fd40:a652:103:100::3 address.

The problem I am having is that I cannot get the palo alto 3260 to sync with the MX10003. I have configured another Juniper device with the same trusted key 5 and it syncs with the MX10003 with no issues. Also, the Palo Alto has no issues syncing with the primary NTP server. This leads me to believe I have both devices configured properly, but for some reason the Palo won't sync with the Juniper router. When I issue the "show ntp" command in the Palo Alto 3260 I get this:

show ntp

    NTP state:
NTP synched to fd40:a652:205:81::123
NTP server: fd40:a652:205:81::123
    status: synched
    reachable: yes
    authentication-type: symmetric key
NTP server: fd40:a652:103:100::3
    status: rejected
    reachable: no
    authentication-type: symmetric key

Also, the service route for the Palo Alto is set to use the management interface for ipv6 and I can definitely ping the router from the Palo Alto.

Any ideas on how I can troubleshoot this further? I'm not to certain on how to perform a Cisco style debug in the Palo Alto or Juniper device so I'm looking for recommendations. Thanks.

Answer 1

This was resolved after modifying the format of the authentication key in the Juniper router. We had to enter the key a specific way. For example, if the key was aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa (40 charachters), we would need to set the value in the router as "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" (quotes included in the cli command).