Configuring NTP authentication using the CLI

This topic describes how to configure NTP authentication using the CLI.

Enabling NTP authentication and configuring keys

Perform the tasks in this section in the order shown to configure NTP authentication.

Obtain the authentication keys from the NTP server:

On the NTP server, map a key ID from 1–16 to an MD5 or SHA1 hash value.
Repeat the previous step for additional key ID/value pairs.
Copy and paste the key ID/value pairs so they can be configured on the appliance later in this procedure.

Enable NTP and NTP authentication:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

View the current status.
```
hostname (config) # show ntp configured
```
If NTP enabled: no appears in the command output, enable NTP.
```
hostname (config) # ntp enable
```
If NTP Authentication enabled: no appears is the command output, enable NTP authentication.
```
hostname (config) # ntp authentication enable
```

Define the authentication keys:

Use the following command to configure the key ID and hash value you obtained from the NTP server:
```
hostname (config) # ntp authentication key <number> hash <type> <value>
```
where:
- <number> is an integer from 1–16
- <type> is md5 or sha1
- <value> is the hash value
Repeat the previous step for each key you want to define.

View the configured keys.

hostname (config) # show ntp authentication configured

Save your changes.
```
hostname (config) # write memory
```

Assign the keys to the NTP servers:

To assign a key to an NTP server, use the ntp server <server> authentication key <number> command, where <server> is the IP address or hostname of the NTP server, and <number> is the integer that you assigned to the key in the previous task
The following example assigns hash key 1 to the NTP server 0.acme.pool.ntp.org:
```
hostname (config) # ntp server 0.acme.pool.ntp.org authentication key 1
```
Repeat the previous step for each key you want to define.
View the assigned keys:
```
hostname (config) # show ntp configured
```

Verify that the keys are valid:

hostname (config) # show ntp authentication

Save your changes:
```
hostname (config) # write memory
```

Disabling NTP authentication and removing keys

You cannot delete an authentication key from the system if it is mapped to an NTP server. If a key is mapped to an NTP server, you must disable NTP authentication on that server before you delete the key.

To disable NTP authentication on the system:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

Disable NTP authentication:

hostname (config) # no ntp authentication

Save your changes:
```
hostname (config) # write memory
```

To disable NTP authentication on a specific server:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

To disable NTP authentication with a specified NTP server, use the no ntp server <server> authentication command, where <server> is the hostname or IP address of the NTP server.
The following example disables NTP authentication with the NTP server with hostname 1.acme.pool.ntp.org:
```
hostname (config) # no ntp server 1.acme.pool.ntp.org authentication
```
Save your changes:
```
hostname (config) # write memory
```

To delete an NTP authentication key:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

To delete a key, use the no ntp authentication key <number> command, where <number> is the key ID.
```
hostname (config) # no ntp authentication key 1
```
Save your changes:
```
hostname (config) # write memory
```

Examples

The following example shows the current configuration.

hostname (config) # show ntp configured
NTP enabled: yes
NTP Authentication enabled: yes
No NTP peers configured.
NTP server 0.acme.pool.ntp.org
  Enabled: yes
  NTP version: 4
  Key: none
NTP server 1.acme.pool.ntp.org
  Enabled: yes
  NTP version: 4
  Key: none
NTP server 2.acme.pool.ntp.org
  Enabled: yes
  NTP version: 4
  Key: none

The following example defines two authentication keys and assigns each one to an NTP server.

hostname (config) # ntp authentication key 1 hash md5 153ffa51cc765fb257e384e8e6aec8fe

hostname (config) # ntp server 0.acme.pool.ntp.org key 1

hostname (config) # ntp authentication key 2 hash sha1 27a048b642be47d50a9c38427495945429597d91

hostname (config) # ntp server 1.acme.pool.ntp.org key 2

hostname (config) # show ntp configured
NTP enabled: yes
NTP Authentication enabled: yes
No NTP peers configured.
NTP server 0.acme.pool.ntp.org
  Enabled: yes
  NTP version: 4
  Key: 1
NTP server 1.acme.pool.ntp.org
  Enabled: yes
  NTP version: 4
  Key: 2
NTP server 2.acme.pool.ntp.org
  Enabled: yes
  NTP version: 4
  Key: none

hostname (config) # show ntp authentication configured
NTP enabled: yes
NTP Authentication enabled: yes
NTP Key Number 1
  Type: md5
  Key: 153ffa51cc765fb257e384e8e6aec8fe
NTP Key Number 2
  Type: sha1
  Key: 27a048b642be47d50a9c38427495945429597d91

hostname (config) # show ntp authentication
NTP is administratively enabled.
NTP authentication is administratively enabled.
Active servers and peers:

Address           auth      keyid
=====================================
172.16.2.3        ok         1
10.30.4.3         ok         2
192.168.10.12     none       none

The following example disables NTP authentication on the 1.acme.pool.ntp.org server and then deletes the key it was using from the system.

hostname (config) # no ntp server 1.acme.pool.ntp.org authentication
hostname (config) # no ntp authentication key 2