NTP server configuration

Instead of manually setting the system date and time, you can specify one or more Network Time Protocol (NTP) servers and peers to synchronize the time automatically. By default, NTP version 4 is used, but you can specify version 3 instead. You can perform a one-time action that synchronizes the system clock with a specific NTP server. NTP is enabled by default. The appliance is pre-configured with four NTP servers your appliance can use if it can reach them.

The appliance can authenticate that the time it obtains from an NTP server is from a known and trusted source. The system clock is updated only if a key ID in the incoming NTP packet matches a key ID configured on the appliance, and if that key ID is mapped to the same MD5 or SHA1 hash value stored on both the NTP server and the appliance. If the key ID/value pair on NTP server and appliance do not match, the clock is not updated. NTP authentication is enabled by default, but the NTP server must already have the key ID/value pair, and the same key ID/value pair must be configured on the appliance and then associated with the NTP server. A total of 16 keys can be configured on a single appliance.

Prerequisites

Admin access to configure NTP
Monitor, Operator, or Admin access to view NTP configuration and status information
Connectivity to at least one NTP server
For NTP authentication: Authentication key ID/value pairs on the NTP servers for which authentication will be configured

Configuring NTP servers using the Web UI

Use the Enable NTP section of the Date and Time Settings page to configure NTP servers.

Note
The Intelligent Virtual Execution - Server appliance has a CLI and a Web UI. The recommended method for this configuration on a Intelligent Virtual Execution - Server appliance is through the Central Management System Web UI.

To configure NTP servers:

Click the Settings tab.
Click Date and Time on the sidebar.
Click Add NTP Server.
Enter the IP address or hostname of the NTP server that you want to use in the Add NTP Server box.
Click Add.
Repeat the previous three steps to add additional servers.
To synchronize the system time once with a selected NTP server, click Update next to the server entry.
The time is updated, and the needed adjustment is displayed in a message on the page.
To delete an NTP server, select the checkbox next to the server and then click Remove NTP Server.
Click Yes to confirm the action.

Configuring NTP servers using the CLI

Use the commands in this topic to configure NTP servers.

Note
See Configuring NTP authentication using the CLI for information about ensuring that the system clocks are only updated if the time is obtained from a trusted source.

To enable and configure NTP servers:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

Enable NTP synchronization:
```
hostname (config) # ntp enable
```
Specify the primary NTP server:
```
hostname (config) # ntp server <server>
```
where <server> is the IPv4 or IPv6 address, or hostname of the NTP server.
Repeat the previous step for the secondary NTP server and any additional NTP servers.

To change the NTP version:

Specify the version:
```
hostname (config) # ntp
```
To change the version on an NTP server:
```
hostname (config) ntp server <server> version <version>
```
where <server> is the IPv4 or IPv6 address, or hostname of the NTP server, and <version> is either 3 or 4
To change the version on an NTP peer:
```
hostname (config) ntp peer <peer> version <version>
```
where <peer> is the IPv4 or IPv6 address, or hostname of the NTP peer, and <version> is either 3 or 4.
Save your changes:
```
hostname (config) # write memory
```

To disable NTP:

Disable NTP synchronization:

hostname (config) # ntp disable

hostname (config) # no ntp enable

Save your changes:
```
hostname (config) # write memory
```

To synchronize the system time with a specific NTP server one time:

Synchronize the system time:
```
hostname (config) # ntpdate <server>
```
where <server> is the IPv4 or IPv6 address, or hostname of the NTP server to synchronize with.
Save your changes:
```
hostname (config) # write memory
```

To view the current NTP runtime state and configuration:

Go to CLI standard mode.
View the information:
```
hostname > show ntp
```

To view the configured NTP servers and their settings:

Go to CLI standard mode.
View the information:
```
hostname > show ntp configured
```

Examples

The following example configures two NTP servers and an NTP peer.

hostname (config) # ntp server 0.acme.pool.ntp.org
hostname (config) # ntp server 1.acme.pool.ntp.org
hostname (config) # ntp peer 5.acme.pool.ntp.org
hostname (config) # show ntp configured
NTP enabled: yes
NTP Authentication enabled: yes
NTP peer 5.acme.pool.ntp.org
  Enabled: yes
  NTP version: 4
  Key: none
NTP server 0.acme.pool.ntp.org
  Enabled: yes
  NTP version: 4
  Key: none
NTP server 1.acme.pool.ntp.org
  Enabled: yes
  NTP version: 4
  Key: none

The following example disables NTP synchronization on the system.

hostname (config) # no ntp enable
hostname (config) # show ntp configured
NTP enabled: no
NTP Authentication enabled: yes
No NTP peers configured.
NTP server 0.acme.pool.ntp.org
  Enabled: yes
  ...
hostname (config) # show ntp
NTP is administratively disabled.
NTP Authentication is administratively enabled.
Clock is unsynchronized.
No NTP associations present.

The following example temporarily disables NTP on the "3.acme.pool.ntp.org" server.

hostname (config) # ntp server 3.acme.pool.ntp.org disable
hostname (config) # show ntp configured
NTP enabled: yes
NTP Authentication enabled: yes
No NTP peers configured.
NTP server 0.acme.pool.ntp.org
  Enabled: yes
  ...
NTP server 3.acme.pool.ntp.org
  Enabled: no
  ...

The following example removes the "2.acme.pool.ntp.org" NTP server.

hostname (config) # no ntp server 2.acme.pool.ntp.org

The following example synchronizes the system clock with the NTP server.

hostname (config) # ntpdate 0.acme.pool.ntp.org
 adjust time server 192.168.120.23 offset -0.023716 sec

The following example changes the NTP version on the "3.acme.pool.ntp.org" server to version 3.

hostname (config) # ntp server 3.acme.pool.ntp.org version 3
hostname (config) # show ntp configured
NTP enabled: yes
NTP Authentication enabled: yes
No NTP peers configured.
...
NTP server 3.acme.pool.ntp.org
  Enabled: yes
  NTP version: 3
  Key: none

The following example shows the current NTP runtime state and configuration.

hostname > show ntp
NTP is administratively enabled.
NTP Authentication is administratively enabled.
Clock is synchronized. Reference: 10.255.34.6  Offset: 1.713 ms.
Active servers and peers:
                                                           Poll    Last
             Conf                     Offset   Ref         Interv  Resp
Address      Type  Status     Stratum (msec)   Clock       (sec)   (sec)
===========================================================================
192.168.1.1  n/a   candidat (+)   2   -0.233   10.2.3.4      64     60 
10.2.3.4     n/a   outlyer  (-)   2   12.069   192.168.2.2   64     50
172.16.4.5   n/a   candidat (+)   2   -0.958   10.5.6.7      64     50
10.255.34.6  n/a   sys.peer (*)   2   1.713    172.16.3.4    64     45

The following example shows the configured NTP servers and their settings:

hostname > show ntp configured
NTP enabled: yes
NTP Authentication enabled: yes
No NTP peers configured.
NTP server 0.acme.pool.ntp.org
  Enabled: yes
  NTP version: 4
NTP server 1.acme.pool.ntp.org
  Enabled: yes
  NTP version: 4
NTP server 2.acme.pool.ntp.org
  Enabled: yes
  NTP version: 4
NTP server 3.acme.pool.ntp.org
  Enabled: yes
  NTP version: 4

Configuring NTP authentication using the CLI

This topic describes how to configure NTP authentication using the CLI.

Enabling NTP authentication and configuring keys

Perform the tasks in this section in the order shown to configure NTP authentication.

Obtain the authentication keys from the NTP server:

On the NTP server, map a key ID from 1–16 to an MD5 or SHA1 hash value.
Repeat the previous step for additional key ID/value pairs.
Copy and paste the key ID/value pairs so they can be configured on the appliance later in this procedure.

Enable NTP and NTP authentication:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

View the current status.
```
hostname (config) # show ntp configured
```
If NTP enabled: no appears in the command output, enable NTP.
```
hostname (config) # ntp enable
```
If NTP Authentication enabled: no appears is the command output, enable NTP authentication.
```
hostname (config) # ntp authentication enable
```

Define the authentication keys:

Use the following command to configure the key ID and hash value you obtained from the NTP server:
```
hostname (config) # ntp authentication key <number> hash <type> <value>
```
where:
- <number> is an integer from 1–16
- <type> is md5 or sha1
- <value> is the hash value
Repeat the previous step for each key you want to define.

View the configured keys.

hostname (config) # show ntp authentication configured

Save your changes.
```
hostname (config) # write memory
```

Assign the keys to the NTP servers:

To assign a key to an NTP server, use the ntp server <server> authentication key <number> command, where <server> is the IP address or hostname of the NTP server, and <number> is the integer that you assigned to the key in the previous task
The following example assigns hash key 1 to the NTP server 0.acme.pool.ntp.org:
```
hostname (config) # ntp server 0.acme.pool.ntp.org authentication key 1
```
Repeat the previous step for each key you want to define.
View the assigned keys:
```
hostname (config) # show ntp configured
```

Verify that the keys are valid:

hostname (config) # show ntp authentication

Save your changes:
```
hostname (config) # write memory
```

Disabling NTP authentication and removing keys

You cannot delete an authentication key from the system if it is mapped to an NTP server. If a key is mapped to an NTP server, you must disable NTP authentication on that server before you delete the key.

To disable NTP authentication on the system:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

Disable NTP authentication:

hostname (config) # no ntp authentication

Save your changes:
```
hostname (config) # write memory
```

To disable NTP authentication on a specific server:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

To disable NTP authentication with a specified NTP server, use the no ntp server <server> authentication command, where <server> is the hostname or IP address of the NTP server.
The following example disables NTP authentication with the NTP server with hostname 1.acme.pool.ntp.org:
```
hostname (config) # no ntp server 1.acme.pool.ntp.org authentication
```
Save your changes:
```
hostname (config) # write memory
```

To delete an NTP authentication key:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

To delete a key, use the no ntp authentication key <number> command, where <number> is the key ID.
```
hostname (config) # no ntp authentication key 1
```
Save your changes:
```
hostname (config) # write memory
```

Examples

The following example shows the current configuration.

hostname (config) # show ntp configured
NTP enabled: yes
NTP Authentication enabled: yes
No NTP peers configured.
NTP server 0.acme.pool.ntp.org
  Enabled: yes
  NTP version: 4
  Key: none
NTP server 1.acme.pool.ntp.org
  Enabled: yes
  NTP version: 4
  Key: none
NTP server 2.acme.pool.ntp.org
  Enabled: yes
  NTP version: 4
  Key: none

The following example defines two authentication keys and assigns each one to an NTP server.

hostname (config) # ntp authentication key 1 hash md5 153ffa51cc765fb257e384e8e6aec8fe

hostname (config) # ntp server 0.acme.pool.ntp.org key 1

hostname (config) # ntp authentication key 2 hash sha1 27a048b642be47d50a9c38427495945429597d91

hostname (config) # ntp server 1.acme.pool.ntp.org key 2

hostname (config) # show ntp configured
NTP enabled: yes
NTP Authentication enabled: yes
No NTP peers configured.
NTP server 0.acme.pool.ntp.org
  Enabled: yes
  NTP version: 4
  Key: 1
NTP server 1.acme.pool.ntp.org
  Enabled: yes
  NTP version: 4
  Key: 2
NTP server 2.acme.pool.ntp.org
  Enabled: yes
  NTP version: 4
  Key: none

hostname (config) # show ntp authentication configured
NTP enabled: yes
NTP Authentication enabled: yes
NTP Key Number 1
  Type: md5
  Key: 153ffa51cc765fb257e384e8e6aec8fe
NTP Key Number 2
  Type: sha1
  Key: 27a048b642be47d50a9c38427495945429597d91

hostname (config) # show ntp authentication
NTP is administratively enabled.
NTP authentication is administratively enabled.
Active servers and peers:

Address           auth      keyid
=====================================
172.16.2.3        ok         1
10.30.4.3         ok         2
192.168.10.12     none       none

The following example disables NTP authentication on the 1.acme.pool.ntp.org server and then deletes the key it was using from the system.

hostname (config) # no ntp server 1.acme.pool.ntp.org authentication
hostname (config) # no ntp authentication key 2