簡介
本檔案介紹如何疑難排解Cisco DNA Center(DNAC)上的網路時間協定(NTP)問題。
必要條件
需求
採用元件
本檔案中的資訊是根據以下軟體版本:
- Cisco DNA中心2.3.3
- Cisco DNA中心2.3.5
本文中的資訊是根據特定實驗室環境內的裝置所建立。文中使用到的所有裝置皆從已清除(預設)的組態來啟動。如果您的網路運作中,請確保您瞭解任何指令可能造成的影響。
背景資訊
時間同步對於資料準確性和跨多主機群集的協調處理至關重要。在生產環境中部署裝置之前,請確保裝置系統時鐘上的時間為最新,並且您指定的NTP伺服器保持準確的時間。如果您計畫將裝置與ISE整合,還必須確保ISE與裝置相同的NTP服務器同步。
對於生產部署,建議您至少配置三個NTP服務器。
NTP版本4使用UDP埠123與DNAC進行通訊。
在CIMC上驗證到NTP
第1步 — 使用您在Enable Browser access to Cisco Integrated Management Controller中設定的思科IMC IP地址、使用者ID和密碼登入裝置Cisco IMC。
第2步 — 將裝置硬體與用於管理網路的網路時間協定(NTP)伺服器同步,如下所示:
- 在Cisco IMC GUI的左上角,按一下切換導覽圖示。
- 在Cisco IMC選單中,選擇 > ,然後選擇 Setting頁籤。
- 確保選中NTP Enabled覈取方塊,並在編號的伺服器欄位中輸入最多四個NTP伺服器主機名或地址。
- 思科IMC驗證您的條目,然後開始將裝置硬體上的時間與NTP伺服器上的時間同步。
CIMC NTP配置頁
檢視DNAC上的NTP配置
- 檢查DNAC中配置的NTP服務,確認NTP有*伺服器資訊
maglev@maglev-master:~$ ntpq -pn
remote refid st t when poll reach delay offset jitter
==============================================================================
*ntp.server.local .GNSS. 2 u 823 1024 0 0.263 0.144 0.000
10.81.254.131 .GNSS. 1 u 835 1024 377 72.324 0.382 0.087
- 使用命令timedatectl確認System clock synchronized是否已同步。
maglev@maglev-master:~$ timedatectl status
Local time: Thu 2023-09-28 20:27:13 UTC
Universal time: Thu 2023-09-28 20:27:13 UTC
RTC time: Thu 2023-09-28 20:27:13
Time zone: Etc/UTC (UTC, +0000)
System clock synchronized: yes
systemd-timesyncd.service active: no
RTC in local TZ: no
- 檢查ntp.conf檔案上是否正確配置了NTP伺服器。
maglev@maglev-master:~$ cat /etc/ntp.conf
#---------------------------------------------------------------------
# Modified by Maglev: Mon, 25 Sep 2023 21:04:04 UTC
# maglev-config 68913
#---------------------------------------------------------------------
tinker panic 0
driftfile /var/lib/ntp/ntp.drift
statsdir /var/log/ntpstats/
statistics loopstats peerstats clockstats
filegen loopstats file loopstats type day enable
filegen peerstats file peerstats type day enable
filegen clockstats file clockstats type day enable
server 10.81.254.131 iburst
server ntp.server.local iburst
restrict -4 default kod notrap nomodify nopeer noquery
restrict -6 default kod notrap nomodify nopeer noquery
restrict 127.0.0.1
restrict ::1
interface ignore 0.0.0.0
interface listen enterprise
interface listen management
interface listen internet
interface listen cluster
驗證DNAC上的NTP
- 使用FQDN配置NTP時,請驗證DNAC是否可以解析A和PTR記錄。
maglev@maglev-master:~$ nslookup
>set type=A
> ntp.server.local
Server: 10.0.0.53
Address: 10.0.0.53#53
Non-authoritative answer:
Name: ntp.server.local
Address: 10.81.254.202
>set type=PTR
> 10.81.254.202
Server: 10.0.0.53
Address: 10.0.0.53#53
10.254.81.10.in-addr.arpa name = ntp.server.local.
maglev@maglev-master:~$ ping ntp.server.local
PING ntp.server.local (10.81.254.202) 56(84) bytes of data.
64 bytes from ntp.server.local (10.81.254.202): icmp_seq=1 ttl=53 time=72.8 ms
64 bytes from ntp.server.local (10.81.254.202): icmp_seq=2 ttl=53 time=71.9 ms
64 bytes from ntp.server.local (10.81.254.202): icmp_seq=3 ttl=53 time=72.0 ms
^C
--- ntp.server.local ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 72.506/72.634/72.853/0.269 m
maglev@maglev-master:~$ nc -zvu ntp.server.local 123
Connection to ntp.server.local 123 port [udp/ntp] succeeded!
- 執行資料包捕獲,並確認NTP通訊與NTPv4版本相同。
maglev@maglev-master:~$ sudo tcpdump -i any host ntp.server.local and port 123 --immediate-mode
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
20:19:23.967314 IP flink-web.ndp.svc.cluster.local.ntp > ntp.server.local.ntp: NTPv4, Client, length 48
20:19:23.967329 IP flink-web.ndp.svc.cluster.local.ntp > ntp.server.local.ntp: NTPv4, Client, length 48
20:19:24.040064 IP ntp.server.local.ntp > flink-web.ndp.svc.cluster.local.ntp: NTPv4, Server, length 48
20:19:24.040064 IP ntp.server.local.ntp > flink-web.ndp.svc.cluster.local.ntp: NTPv4, Server, length 48
maglev@maglev-master:~$ systemctl status ntp
* ntp.service - Network Time Service
Loaded: loaded (/lib/systemd/system/ntp.service; enabled; vendor preset: enabled)
Active: active (running) since Thu 2023-09-28 20:19:20 UTC; 22min ago
Docs: man:ntpd(8)
Process: 31746 ExecStart=/usr/lib/ntp/ntp-systemd-wrapper (code=exited, status=0/SUCCESS)
Main PID: 31781 (ntpd)
Tasks: 2 (limit: 13516)
CGroup: /system.slice/ntp.service
`-31781 /usr/sbin/ntpd -p /var/run/ntpd.pid -g -u 107:111
Sep 28 20:19:20 maglev-master-10-88-244-151 ntpd[31781]: restrict ::: KOD does nothing without LIMITED.
Sep 28 20:19:20 maglev-master-10-88-244-151 ntpd[31781]: Listen and drop on 0 v6wildcard [::]:123
Sep 28 20:19:20 maglev-master-10-88-244-151 ntpd[31781]: Listen normally on 1 lo 127.0.0.1:123
Sep 28 20:19:20 maglev-master-10-88-244-151 ntpd[31781]: Listen normally on 2 management 10.88.244.151:123
Sep 28 20:19:20 maglev-master-10-88-244-151 ntpd[31781]: Listen normally on 3 enterprise 192.168.31.2:123
Sep 28 20:19:20 maglev-master-10-88-244-151 ntpd[31781]: Listen normally on 4 lo [::1]:123
Sep 28 20:19:20 maglev-master-10-88-244-151 ntpd[31781]: Listen normally on 5 management [fe80::be26:c7ff:fe0c:82e6%5447]:123
Sep 28 20:19:20 maglev-master-10-88-244-151 ntpd[31781]: Listen normally on 6 enterprise [fe80::b28b:cfff:fe6a:9e1c%5449]:123
Sep 28 20:19:20 maglev-master-10-88-244-151 ntpd[31781]: Listen normally on 7 cluster [fe80::b28b:cfff:fe6a:9e1d%5450]:123
Sep 28 20:19:20 maglev-master-10-88-244-151 ntpd[31781]: Listening on routing socket on fd #24 for interface updates
注意:如果需要,可以使用sudo system restart ntp命令重新啟動NTP服務。 這沒有任何影響。
排除DNAC上的NTP故障
- 檢視maglev_config_wizard.log檔案。
maglev@maglev-master:~$ cat /var/log/maglev_config_wizard.log | grep -i ntp
| 2023-09-28 00:47:32,790 | DEBUG | 25344 | MainThread | 140017254479680 | root | ansible.py:495 | changed: [localhost] => {"changed": true, "cmd": "/opt/maglev/bin/check_ntp.sh 500 299", "delta": "0:00:00.018699", "end": "2023-09-28 00:47:32.764617", "rc": 0, "start": "2023-09-28 00:47:32.745918", "stderr": "", "stderr_lines": [], "stdout": "PASSED", "stdout_lines": ["PASSED"]}
| 2023-09-28 00:47:33,068 | DEBUG | 25344 | MainThread | 140017254479680 | root | ansible.py:495 | ok: [localhost] => {"ansible_facts": {"ntp_sync_check": "PASSED"}, "changed": false}
"msg": "Check NTP limit PASSED"
changed: [localhost] => {"changed": true, "cmd": "/opt/maglev/bin/check_ntp.sh 500 299", "delta": "0:00:00.018699", "end": "2023-09-28 00:47:32.764617", "rc": 0, "start": "2023-09-28 00:47:32.745918", "stderr": "", "stderr_lines": [], "stdout": "PASSED", "stdout_lines": ["PASSED"]}
ok: [localhost] => {"ansible_facts": {"ntp_sync_check": "PASSED"}, "changed": false}
"msg": "Check NTP limit PASSED"
- 下一節摘錄顯示了NTP不同步或出現通訊問題時出現的錯誤。
maglev@maglev-master:~$ cat /var/log/maglev_config_wizard.log | grep -i ntp
| 2023-07-19 02:36:41,396 | INFO | 76230 | MainThread | 140599082059584 | root | certs.py:142 | renew_certs : Check NTP limits |
| 2023-07-19 02:36:41,703 | DEBUG | 76230 | MainThread | 140599082059584 | root | ansible.py:495 | changed: [localhost] => {"changed": true, "cmd": "/opt/maglev/bin/check_ntp.sh 500 299", "delta": "0:00:00.014850", "end": "2023-07-19 02:36:41.679386", "rc": 0, "start": "2023-07-19 02:36:41.664536", "stderr": "", "stderr_lines": [], "stdout": "WARNING: Could not get Offset or Jitter from ntp peer", "stdout_lines": ["WARNING: Could not get Offset or Jitter from ntp peer"]}
| 2023-07-19 02:36:41,960 | DEBUG | 76230 | MainThread | 140599082059584 | root | ansible.py:495 | ok: [localhost] => {"ansible_facts": {"ntp_sync_check": "WARNING: Could not get Offset or Jitter from ntp peer"}, "changed": false}
"msg": "Check NTP limit WARNING: Could not get Offset or Jitter from ntp peer"
| 2023-07-19 02:36:42,635 | INFO | 76230 | MainThread | 140599082059584 | root | certs.py:142 | renew_certs : Fail if NTP not synched |
TASK [renew_certs : Check NTP limits] ******************************************
maglev@maglev-master:~$ cat /var/log/maglev_config_wizard.log | grep -i ntp
| 2023-09-12 18:21:29,564 | ERROR | 82110 | MainThread | 139737866331968 | maglev_config_wizard.managers.ntp.NtpManager | ntp.py:52 | Unable to sync with time server 10.88.14.200 |
| 2023-09-12 18:21:34,569 | ERROR | 82110 | MainThread | 139737866331968 | maglev_config_wizard.managers.ntp.NtpManager | ntp.py:164 | Unable to configure NTP after 2 attempts |
- 如果需要更改NTP伺服器,請使用sudo maglev-config update 命令。
相關資訊