0

I'm using a Microsemi S650 as the primary ntp server and a Juniper MX10003 as the secondary ntp server. I have the palo alto 3260 configured as follows:

    [edit deviceconfig system ntp-servers]
    ADMIN@PALOALTO-3260# show
    ntp-servers {
    primary-ntp-server {
    ntp-server-address fd40:a652:205:81::123;
     authentication-type {
      symmetric-key {
       algorithm {
       sha1 {
        authentication-key -AQ==A2yJAAeGbGTWyC8VvVcfpy26eRw=yrW8b/T3Jy7JBO39p2jxJJIKtK0Zmcf0hpKkBVObeE5yRXhcNw7d5m2kcRJwugdy;
      }
    }
       key-id 2;
  }
}
      }
secondary-ntp-server {
ntp-server-address fd40:a652:103:100::3;
authentication-type {
  symmetric-key {
    key-id 5;
    algorithm {
      sha1 {
        authentication-key -AQ==A2yJAAeGbGTWyC8VvVcfpy26eRw=yrW8b/T3Jy7JBO39p2jxJJIKtK0Zmcf0hpKkBVObeE5yRXhcNw7d5m2kcRJwugdy;
      }
    }
  }
}

} }

The MX10003 is configured as follows:

{master}[edit system ntp]
    ADMIN@MX1003-A3-RE0# show
    boot-server fd40:a652:205:81::123;
    authentication-key 3 type md5 value "$8$aes256-gcm$hmac-sha2-256$100$qj7VKJq6yp4$uleP/L5JAwqyxXz8Ycu+rg$0cSalY+VuOGOQWHUzeftUw$OV8LtMSs6Y/+i2Xnd5mx"; ## SECRET-DATA
    authentication-key 1 type md5 value "$8$aes256-gcm$hmac-sha2-256$100$1OUG+SJUcwQ$it9a/nJ5LtudKIvba0rAhw$IHYjs1Yf0568nez75hJP1g$TZmXQygdjl5OTD9yFZ/P"; ## SECRET-DATA
    authentication-key 5 type sha1 value "$8$aes256-gcm$hmac-sha2-256$100$lPz+7VuPMAM$9cfIRszWmHUTvHX7FO9Q9g$M7RbVvZCZVw4rY82p5f+3g$MfkbgtQDrDq26voT21BBAWlcbketGALnzM2RL8jJBLwE45LvpN0ahw"; ## SECRET-DATA
    server fd40:a652:205:81::123 key 1 prefer; ## SECRET-DATA
    server fd40:a652:103:100::3 key 5 prefer; ## SECRET-DATA
    trusted-key [ 1 3 5 ];
    source-address fd40:a652:103:100::3;

*NOTE: the MX10003's address is the fd40:a652:103:100::3 address.

The problem I am having is that I cannot get the palo alto 3260 to sync with the MX10003. I have configured another Juniper device with the same trusted key 5 and it syncs with the MX10003 with no issues. Also, the Palo Alto has no issues syncing with the primary NTP server. This leads me to believe I have both devices configured properly, but for some reason the Palo won't sync with the Juniper router. When I issue the "show ntp" command in the Palo Alto 3260 I get this:

show ntp

    NTP state:
NTP synched to fd40:a652:205:81::123
NTP server: fd40:a652:205:81::123
    status: synched
    reachable: yes
    authentication-type: symmetric key
NTP server: fd40:a652:103:100::3
    status: rejected
    reachable: no
    authentication-type: symmetric key

Also, the service route for the Palo Alto is set to use the management interface for ipv6 and I can definitely ping the router from the Palo Alto.

Any ideas on how I can troubleshoot this further? I'm not to certain on how to perform a Cisco style debug in the Palo Alto or Juniper device so I'm looking for recommendations. Thanks.

  • I recommend you confirm NTP traffic is really being exchanged between the hosts. Juniper has tcpdump available via the CLI command monitor traffic interface ... Be sure to look for some pings/etc first, as the way this is implemented in Junos comes with limitations; if packets aren't reaching the control-plane it can't see them. Here is a KB article that will help with the interface syntax: kb.juniper.net/InfoCenter/index?page=content&id=KB33629 – Jeff Wheeler May 27 at 18:36
  • Separately, if your NTP traffic is coming in via the Juniper device's data-plane (as opposed to via a management ethernet port) that traffic will traverse the lo0 firewall filter. This is an excellent place to add a firewall term with an action like then { log; accept; count NTP; } so you can use show firewall log to learn more about what's happening. – Jeff Wheeler May 27 at 18:41
  • 1
    @JeffWheeler Thanks for that info. I added the "then log" to our filter protecting the RE. The "show firewall log" command definitely shows the ntp packets being accepted and the command "monitor traffic interface xe-1/0/1:2.200 matching "port 123 && host fd40:a652:205:81::80b1" detail no-resolve" also confirms the NTP packets coming in/out. I've copied and pasted the shared keys so I know 100% they match. I'm pretty stumped why the device won't sync and why the status is "rejected" in the Palo Alto. – Ben May 27 at 19:02
  • does the MX have a route to the source address the Palo is using to request NTP? Eg: sometimes you may see a box source from a management or loopback interface – Benjamin Dale Jun 2 at 1:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.