To control access to Network Time Protocol (NTP) services for an IPv4 or IPv6 access list, use the access-group command in one of the NTP configuration modes. To remove the access-group command from the configuration file and restore the system to its default condition with respect to this command, use the no form of this command.

Command Default

No NTP access control is configured.

Command Modes

NTP configuration

VRF-specific NTP configuration

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.

The access group options are scanned in the following order from least restrictive to most restrictive:

1. peer—Allows time requests and NTP control queries and allows the router to synchronize itself to a system whose address passes the access list criteria.

2. serve—Allows time requests and NTP control queries, but does not allow the router to synchronize itself to a system whose address passes the access list criteria.

3. serve-only—Allows only time requests from a system whose address passes the access list criteria.

4. query-only—Allows only NTP control queries from a system whose address passes the access list criteria.

Access is granted for the first match that is found. If no access groups are specified, all access is granted to all sources. If any access groups are specified, only the specified access is granted. This facility provides minimal security for the time services of the system. However, it can be circumvented by a determined programmer. If tighter security is desired, use the NTP authentication facility.

If you use the access-group command in a VRF-specific NTP configuration mode, the command is applied to the specific VRF. If you are not in a VRF-specific NTP configuration mode, the command is applied to the default VRF unless you use the vrf vrf-name keyword and argument to specify a VRF.

Related Commands

To enable Network Time Protocol (NTP) authentication, use the authenticate command in NTP configuration mode. To restore the system to its default condition, use the no form of this command.

Syntax Description

This command has no keywords or arguments.

Command Default

No NTP authentication is configured.

Command Modes

NTP configuration

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.

Use the authenticate command to prevent the system from synchronizing with unauthenticated and unconfigured network peers.

If the system has been configured with the broadcast client or multicast client command in NTP configuration mode, and when the system receives an incoming symmetric active NTP packet, or if the system receives a broadcast or multicast mode NTP packet, it can set up an ephemeral peer association in order to synchronize with the sender.

If the authenticate command is specified, and when a symmetric active, broadcast, or multicast NTP packet is received, the system will not synchronize to the peer unless the packet carries one of the authentication keys specified in the trusted-key command.

You must enable authenticate when enabling broadcast client or multicast client command in NTP configuration mode unless you have other measures (such as using the access-group command in NTP configuration mode) to prevent unauthorized hosts from communicating with the NTP service on the device.

Use the no authenticate command to allow synchronizing with unauthenticated and unconfigured network peers.

The authenticate command does not ensure authentication of peer associations that are created using the server and peer commands in NTP configuration mode. When creating associations using the server and peer commands in NTP configuration mode, specify the key keyword to ensure the authentication of packets that move to and from the remote peer. See the documentation of the respective commands for more information.

To define an authentication key for a trusted Network Time Protocol (NTP) time source, use the authentication-key command in NTP configuration mode. To restore the system to its default condition, use the no form of this command.

Command Default

No authentication key is defined for NTP.

Command Modes

NTP configuration

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.

Use the authentication-key command to define authentication keys for use with trusted NTP time sources.

Note	When this command is written to NVRAM, the key is encrypted so that it is not displayed when the configuration is displayed.

To create a Network Time Protocol (NTP) broadcast server on a specified NTP interface, use the broadcast command in NTP interface configuration mode. To remove the command from the configuration file and restore the system to its default condition, use the no form of this command.

Command Default

No NTP broadcast servers are configured.

Command Modes

NTP interface configuration

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.

Use the broadcast command to create an NTP broadcast server on an NTP interface to send NTP broadcast packets.

Use the broadcast client command to set a specific interface to receive NTP broadcast packets.

To allow a networking device to receive Network Time Protocol (NTP) broadcast packets on an interface, use the broadcast client command in NTP interface configuration mode. To remove the configuration and restore the system to its default condition, use the no form of this command.

Syntax Description

This command has no keywords or arguments.

Command Default

No NTP broadcast clients are configured.

Command Modes

NTP interface configuration

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.

Use the broadcast client command to configure and create an NTP broadcast client and to associate the client with an interface to receive and handle NTP broadcast packets. If no NTP client has been created for an interface, the received NTP broadcast packets are dropped. Use this command to allow the system to listen to broadcast packets on an interface-by-interface basis.

To prevent synchronization with unauthorized systems, whenever this command is specified, authentication must be enabled using the authenticate (NTP) command or access must be restricted to authorized systems using the access-group (NTP) command. See the documentation of the respective commands for more information.

To set the estimated round-trip delay between a Network Time Protocol (NTP) client and an NTP broadcast server, use the broadcastdelay command in NTP configuration mode. To restore the system to its default condition, use the no form of this command.

Command Default

microseconds: 3000

Command Modes

NTP configuration

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.

Use the broadcastdelay command to change the default round-trip delay time on a networking device that is configured as a broadcast client.

To enter a Network Time Protocol (NTP) interface mode and run NTP interface configuration commands, use the interface command in one of the NTP configuration modes. To remove an NTP interface configuration, use the no form of this command.

Command Default

No NTP interfaces are configured.

Command Modes

NTP configuration mode

VRF-specific NTP configuration mode

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.

Use the interface command to place the router in NTP interface configuration mode, from which NTP broadcast and multicast servers and clients can be configured. By default, after the NTP process is started, NTP features become available for all interfaces. To exit NTP interface configuration mode, use the exit command.

If you use the interface command in a VRF-specific NTP configuration mode, the command is applied to the specific VRF. If you are not in a VRF-specific NTP configuration mode, the command is applied to the default VRF unless you use the vrf vrf-name keyword and argument to specify a VRF.

By default, NTP is enabled on every interface. To disable NTP on a specific interface, use the interface command with the disable keyword. To reenable NTP on an interface, use the no form of the interface command with the disable keyword.

To configure the router to use its own Network Time Protocol (NTP) master clock to synchronize with peers when an external NTP source becomes unavailable, use the master command in NTP configuration mode. To restore the system to its default condition, use the no form of this command.

Command Default

By default, the master clock function is disabled. When the function is enabled, the default stratum is 8.

Command Modes

NTP configuration

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.

NTP uses the concept of a “stratum” to describe how many NTP “hops” away a machine is from an authoritative time source. A stratum 1 time server has a radio or atomic clock attached directly. A stratum  2 time server receives its time through NTP from a stratum 1 time server, a stratum 3 from a stratum 2, and so on.

Caution

Use the master command with extreme caution. It is easy to override other valid time sources using this command, especially if a low-stratum number is configured. Configuring multiple machines in the same network with the master command can lead to instability in time-keeping if the machines do not agree on the time.

The networking device is normally synchronized, directly or indirectly, with an external system that has a clock. Cisco IOS XR software does not support directly attached radio or atomic clocks. The master command should be used only when there is a temporary disruption in a reliable time service. It should not be employed as an alternative source by itself in the absence of a real-time service.

If the system has the master command configured and it cannot reach any clock that has a lower stratum number, the system claims to be synchronized at the configured stratum number. Other systems synchronize with it through NTP.

Note	The system clock must have been manually set from some source before the master command has an effect. This precaution protects against the distribution of erroneous time after the system is restarted.

To set the maximum number of Network Time Protocol (NTP) associations, use the max-associations command in NTP configuration mode. To restore the default setting, use the no form of this command.

Command Default

The default setting for the maximum number of NTP associations is 100.

Command Modes

NTP configuration

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.

Use the max-associations command to specify the maximum number of associations for an NTP server.

To configure an NTP interface as an NTP multicast client, use the multicast client command in NTP interface configuration mode. To remove the NTP multicast client configuration from an interface, use the no form of this command.

Command Default

The interface is not configured as an NTP multicast client.

Command Modes

NTP interface configuration

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.

Use the multicast client command to configure an NTP interface to receive multicast packets that are sent to an IPv4 or IPv6 multicast group IP address. If you do not specify an IP address, the interface is configured to receive multicast packets sent to the IPv4 multicast group address 224.0.1.1. You can configure multiple multicast groups on the same interface.

To prevent synchronization with unauthorized systems, whenever this command is specified, authentication must be enabled using the authenticate (NTP) command or access must be restricted to authorized systems using the access-group (NTP) command. See the documentation of the respective commands for more information.

To configure an NTP interface as an NTP multicast server, use the multicast destination command in NTP interface configuration mode. To remove the NTP multicast server configuration from an interface, use the no form of this command.

Command Default

The interface is not configured as an NTP multicast server.

Command Modes

NTP interface configuration

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.

Command Default

No defaults behavior or values

Command Modes

Global configuration

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.

NTP configuration commands can also be run from global configuration mode by preceding the command string with the ntp keyword. From NTP configuration mode, the following NTP configuration commands are available:

RP/0/RP0/CPU0:router(config-ntp)# ?
  
    access-group        Control NTP access
    authenticate        Authenticate time sources
    authentication-key  Authentication key for trusted time sources
    broadcastdelay      Estimated round-trip delay
    commit              Commit the configuration changes to running
    default             Set a command to its defaults
    describe            Describe a command without taking real actions
    do                  Run an exec command
    exit                Exit from this submode
    interface           Configure NTP on an interface
    master              Act as NTP master clock
    max-associations    Set maximum number of associations
    no                  Negate a command or set its defaults
    peer                Configure NTP peer
    port                Enable NTP port
    server              Configure NTP server
    show                Show contents of configuration
    source              Configure interface for source address
    trusted-key         Key numbers for trusted time sources
    update-calendar     Periodically update calendar with NTP time
    

Use the ntp command with the vrf vrf-name keyword and argument to enter an NTP configuration mode specific to the specified VRF.

To clear all Network Time Protocol (NTP) peers or a specific NTP peer, use the ntp clear command in EXEC mode.

Command Default

No defaults behavior or values

Command Modes

EXEC

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.

Syntax Description

This command has no keywords or arguments.

Command Default

No defaults behavior or values

Command Modes

EXEC

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.

Use the ntp reset drift command to set the loopfilter state to NSET (never set) and reset the drift. Resetting the loopfilter state and drift enables the router to relearn the frequency of the NTP server clock. This is necessary if there is a synchronization error caused by a large frequency error. This can arise, for example, if the router switches from synchronizing with one NTP server to synchronizing with another NTP server with a different frequency.

To configure the system clock to synchronize a peer or to be synchronized by a peer, use the peer command in one of the NTP configuration modes. To remove the peer command from the configuration file and restore the system to its default condition with respect to the command, use the no form of this command.

Command Default

No peers are configured by default.

Command Modes

NTP configuration

VRF-specific NTP configuration

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.

Use the peer command to allow this machine to synchronize with the peer, or conversely.

Caution

Although using the prefer keyword can help reduce the switching among peers, you should avoid using the keyword because it interferes with the source selection mechanism of NTP and can result in a degradation in performance.

The value for the minpoll keyword must be less than or equal to the value for the maxpoll keyword. If this is not the case, the system issues an error message.

To provide peer-level service (as opposed to client/server-level service), it may be necessary to explicitly specify the NTP version for the peer if it is not version 4.

If you use the peer command in a VRF-specific NTP configuration mode, the command is applied to the specific VRF. If you are not in a VRF-specific NTP configuration mode, the command is applied to the default VRF unless you use the vrf vrf-name keyword and argument to specify a VRF.

Note

To change the configuration of a specific IP address from peer to server or from server to peer, use the no form of the peer or server command to remove the current configuration before you perform the new configuration. If you do not remove the old configuration before performing the new configuration, the new configuration does not overwrite the old configuration.

To allow the system clock to be synchronized by a time server, use the server command in one of the NTP configuration modes. To remove the server command from the configuration file and restore the system to its default condition with respect to this command, use the no form of this command.

Command Default

No servers are configured by default.

Command Modes

NTP configuration

VRF-specific NTP configuration

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.

The value for the minpoll keyword must be less than or equal to the value for the maxpoll keyword. If this is not the case, the system issues an error message.

Using the prefer keyword reduces switching back and forth among servers.

If you use the server command in a VRF-specific NTP configuration mode, the command is applied to the specific VRF. If you are not in a VRF-specific NTP configuration mode, the command is applied to the default VRF unless you use the vrf vrf-name keyword and argument to specify a VRF.

Note

To change the configuration of a specific IP address from peer to server or from server to peer, use the no form of the peer or server command to remove the current configuration before you perform the new configuration. If you do not remove the old configuration before performing the new configuration, the new configuration does not overwrite the old configuration.

To display the system time and date, use the show calendar command in the EXEC .

Syntax Description

This command has no keywords or arguments.

Command Default

None

Command Modes

EXEC

Command History

Usage Guidelines

The time format of the show calendar output depends on the time format set using the clock timezone command.

To display the status of Network Time Protocol (NTP) associations, use the show ntp associations command in privileged EXEC mode.

Command Default

None

Command Modes

EXEC

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.

Output for the show ntp associations command is displayed only if NTP is configured on the router.

Command Default

No defaults behavior or values

Command Modes

EXEC

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.

To use a particular source address in Network Time Protocol (NTP) packets, use the source command in one of the NTP configuration modes. To remove the source command from the configuration file and restore the system to its default condition, use the no form of this command.

Command Default

The source address is determined by the outgoing interface.

Command Modes

NTP configuration

VRF-specific NTP configuration

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.

Use the source command to use a particular source IP address for all NTP packets. The address is taken from the named interface. This command is useful if the address on an interface cannot be used as the destination for reply packets. If the source keyword has been configured with the server (NTP) or peer (NTP) command, that value overrides the global value.

Use the source command in a VRF-specific NTP configuration mode or use the vrf vrf-name keyword and argument to configure the source address for a specific nondefault VRF. Otherwise, the configuration is applied to the default VRF.

To designate a Network Time Protocol (NTP) trusted key, use the trusted-key command in NTP configuration mode. To remove the trusted-key command from the configuration file and restore the system to its default condition with respect to this command, use the no form of this command.

Command Default

No NTP trusted key is designated.

Command Modes

NTP configuration

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.

If authentication is enabled, use the trusted-key command to define one or more key numbers (corresponding to the keys defined with the authentication-key [NTP] command) that a NTP system must provide in its NTP packets for this system to synchronize to it. Because the other system must know the correct authentication key, this precaution provides protection against accidentally synchronizing the system to a system that is not trusted.

To update the calendar periodically from Network Time Protocol (NTP), use the update-calendar command in NTP configuration mode. To remove the update-calendar command from the configuration file and restore the system to its default condition with respect to the command, use the no form of this command.

Syntax Description

This command has no keywords or arguments.

Command Default

This command is disabled.

Command Modes

NTP configuration

Usage Guidelines

To use this command, you must be in a user group associated with a task group that includes appropriate task IDs. If the user group assignment is preventing you from using a command, contact your AAA administrator for assistance.

Your router has a calendar that is separate from the software clock. This calendar runs continuously, even if the router is powered off or rebooted.

If a router is synchronized to an outside time source through NTP, it is a good idea to update the router’s calendar with the time learned from NTP. Otherwise, the calendar may gradually lose or gain time.

After you configure the update-calendar command, NTP updates the calendar with the software clock every hour.