NTP server authentication

I'll put up the master NTP server on Catalyst 4000 series switch. I want to implement authentication between the server and the client. I have the following commands is not working.

What's wrong with the commands below?

Server:

NTP-1 xxx md5 authentication key

authenticate the NTP

NTP master 6

NTP max-associations 10

Client:

NTP-1 xxx md5 authentication key

authenticate the NTP

key to NTP server 10.0.0.1 1

AV

I think there are two separate issues here and they are not really related to each other. It is a question if your switch must be configured as master ntp. If the switch is configured as master ntp, then it will offer his version of time that it is authoritative or not (either correct or not). I think it is a bad idea and hope that this is not something that you did intentionally.

The other question is why the switch is not hours of instruction from the marine server. It seems that there are several reasons why this can happen. It is possible that the NTP requests you are not to get on the server or the server responses aren't you. My guess is that it probably is, since the show ntp association does not show a reference to the server of the Navy clock. Or it is possible that the NTP response is you but there's not enough variability in traffic through the network switch is not able to synchronize with the server. I saw a customer network when it's a problem for a while.

I would say the next step could be to debug ntp package and see if you send to the correct address and see if you have found answers.

HTH

Rick

Tags: Cisco Security

Similar Questions

  • PDC as a NTP server with no external link WAN

    A bit of a unique environment...

    Here's the background: R2 Windows Server 2012 (GUI) virtual (VMware, Hyper-V, don't think that it matters tho?)

    HIGHLY SECURE (No link whatsoever outside the network) environment which is currently in phase of tests .

    Small environment, then domain, DNS, and DHCP controller all-in-one...

    The issue is, this PDC must to also act as NTP server for the whole environment...

    Now, since there is no link with the outside world, I can not synchronize time with a server such as time.windows.com or pool.ntp.org time so I need to manually configure the time on DC1 and let members computers synchronize their time with mine, so we chronological consistent throughout the network, even if it can be turned off in regard to real-time.

    Sounds easy enough, but as my username suggests, I'm a total noob, then how?

    A few items of Microsoft (like this: https://support.microsoft.com/en-us/kb/816042) suggest that to set the internal clock as the source for our NTP server on the domain controller requires changes in the registry... I sincerely hope that as advanced as a 2012 R2 server should be able to something like that happen to without necessary to enter regedit.

    In addition, in the article above, will it work if my domain controller is a virtual machine, or it's only about physical machines?

    And once I have the task, the issue of the domain member computers comes to mind... the following thoughts come to mind:

    -Should I go into each computer only member and point manually to my DC to tell him that his also the NTP?

    -What about some news servers that join the domain?

    -Are there maybe a GPO, I can create this for me? And if so, how? (GPO Noob too = P)

    Thank you to troubleshoot a windows apprentice young power make it work and not get fired! =)

    Kind regards

    knowNoob

    This issue is beyond the scope of this site (for consumers) and to be sure, you get the best (and fastest) reply, we have to ask either on Technet (for IT Pro) or MSDN (for developers)

    If you give us a link to the new thread we can point to some resources it
  • NTP server lag get higher

    Hello

    I installed the 2012 server in vmware esxi

    the server is a satandalone and is not a member of the domain

    I have configured the server to be a ntp client and synchronize time from an ntp server closest to you.

    When I check the offset of the time I get a 0.03 s

    and this result is good for my environment, but after some time the offset increase until it get 0.3 s

    What are the causes of the offset to change after a while and increase so high

    Thank you

    This issue is beyond the scope of this site (for consumers) and to be sure, you get the best (and fastest) reply, we have to ask either on Technet (for IT Pro) or MSDN (for developers)
    *
  • Altered in Cisco Unity Connection and cancelled permits NTP server

    I use Cisco Unity Connection 8.6.1 and cancelled my Inbox licenses.  A few days ago I noticed that the timestamp of the voicemails was different from what said our CUCM so immediately, I assume that the NTP servers were different.  I was correct and made the change on our server CUC.  I came back to add another user, a few days later and was motivated that I didn't have enough licenses.  After researching on it after the fact, it seems that this happened because the value of NTP server is one of the values that cannot change with the current license, and I'm in a State of the trial for 30 days (24 days left now).  Now my problem is that I don't remember what would replace this NTP server.  How can I fix this problem?

    Hi William,.

    I guess the connection of the unit is installed on the virtual machine and therefore license MAC is here

    You can get the rehost license by launching the mail to [email protected] / * /

    regds,

    aamns

  • Can I use the same NTP server configured in the firewall to guard

    I configured the NTP server in my VCSC Expressway it synchronized correctly, but I'm unable to configured in my VCSC Gatekeeper with the same NTP server address that is configured in VCScExpresway.

    Please suggest

    Hello!

    You use in.pool.ntp.org. This isn't a single ntp server, there is a pool of servers,

    then you might see different ntp servers, and they can also change and sometimes

    It can also happen that yo will get a limit down.

    If I get him here, I have for exmple get:

    $host in.pool.ntp.org

    in.pool.ntp.org has address 113.30.137.34

    in.pool.ntp.org has address 119.226.101.131

    and a little later, I got:

    $ host in.pool.ntp.org

    in.pool.ntp.org has address 123.108.225.6

    in.pool.ntp.org has address 125.62.193.121

    In any case you want to configure multiple NTP server addresses.

    So, if you want to use this area (India):

    * You must configure these three host names as described here: http://www.pool.ntp.org/zone/in

    * See who works for DNS resolution (which may also be the problem here)

    * you have a suitable internet access

    * see that the firewall is open to 123 to any host on the internet

    * If you are not in India use a different area

    On the VCS under Maintanance > tools > utilities you could for example check if you can resolve DNS and traceroute/ping external hosts on network.

    The other option is to find at least 2 NTP servers you know and that you can use and set up.

    then you could lock the specific IPS in the firewall, otherwise it should be open to all.

    Its also not hard to set up your own server NTP, incidentally.

  • Cisco ISE synchronization and NTP server

    I am currently implementing Cisco ISE to our customer.

    But having a little problem Cisco ISE cannot synchronize with NTP server.

    Keep in mind, NTP servers in AD.

    Currently, Cisco ISE synchronize just at the local level.

    Cisco ISE implemented distributed mode, when there are two Cisco ISE installed on VMware (Administration & monitoring primary & secondary node), and another is the device (political Service node).

    As a result of it might not sync server NTP and the ISE of Cisco, Cisco ISE often OUT-OF-SYN.

    Is there a solution for this problem?

    Gandhi,

    This is a known issue, I have crossed upwards and have not read that you use AD as your NTP server, there have been problems with integration of the ISE and ACS with AD as their ntp source, please use another device like sources ntp, for example a router.

    Thank you

    Tarik Admani
    * Please note the useful messages *.

  • PIX to function as an Ntp Server

    Hi all

    I ask you if the pix can act as an NTP server with software Version 7.0?

    Thank you & best regards

    Igor.

    No, the PIX OS 7.0 is still just a NTP client!

    http://www.Cisco.com/en/us/products/sw/secursw/ps2120/products_command_reference_chapter09186a008045277f.html#wp1484669

    sincerely

    Patrick

  • PIX as a NTP server for inside networks

    I currently have my PIX receiving NTP of a trusted external source. I would put my switches to pick up their time to the PIX. I don't see anywhere that it is possible. I have tried using my interior of interface as the source server for the customers, but they never receive NTP messages and remain unsynchronized.

    Our PIX is the internal common points for each of our offices (they create our web of connections Internet VPN tunnels) and are the logical choice for traffic NTP ditribute throughout our org.

    Can someone answer for sure that PIX will act as NTP servers when it is called by clients configured for example:

    Insside source NTP server (PIX1_IP)

    This works when PIX1_IP is actually all other(non-PIX) NTP internal source.

    For security reasons, the PIX is only an NTP client. Is not a NTP server and response to queries from the NTP clients. PIX does not meet the NTP queries. If you enable logging on the PIX you can see a syslog message

    % 3 PIX-610001: int_name of interface for the NTP daemon: package refused to

    IP_addr

    OR similar.

    Hope that helps!

  • ESXi 5.1 configured as a NTP server, do not sync with the Local PC

    I have a 5.1 ESXi server configured as an NTP server and a Windows Server 2008 R2 local PC that are not sync.  I understand well, it is not recommended for ESXi, but I read [1] [2] that, whenever an ESXi server is running as a client, it also acts as a server, so I enabled as a NTP client in vSphere by ticking the NTP client, adding some servers to the server list, and then click on run, and I also activated the 123 incoming/outgoing port by adding the shell of ESXi firewall settings.

    I'm pretty sure it isn't a firewall problem.  I completely disabled the firewall on my local PC.  Running "w32tm keyboardists computers: - IP address of the server -" give me the time of the server and running the software NTPQuery gives me an answer back on port 123 of the server time.

    I tried:

    - Date/time settings (right-click on notification area-> set date/time-> Internet time-> set as the IP address of the server) - sync fails (* an error has occurred while Windows timed with - server IP-*)

    - Group Policy Editor (Computer Configuration\Administrative Templates administration\systeme\service Time Service, currently disabled but because I heard this causes problems) - synchronization fails

    - The registry editor (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time\settings) - synchronization fails

    - Command prompt, using:

    w32tm /config /manualpeerlist:-IP of server- /syncfromflags:MANUAL /reliable:yes /update
    net stop w32time && net start w32time
    w32tm /resync /rediscover
    
    
    

    This updates the registry properly, but the outputs "the computer did not resync because no time data was available."  And when I use the command "w32tm/query/source" the source is always "The local CMOS clock."

    Here is the output from w32tm/query /configuration

        [Configuration]
    
    
        EventLogFlags: 2 (Local)
        AnnounceFlags: 5 (Local)
        TimeJumpAuditOffset: 28800 (Local)
        MinPollInterval: 10 (Local)
        MaxPollInterval: 15 (Local)
        MaxNegPhaseCorrection: 3600 (Local)
        MaxPosPhaseCorrection: 3600 (Local)
        MaxAllowedPhaseOffset: 1 (Local)
      
        FrequencyCorrectRate: 4 (Local)
        PollAdjustFactor: 5 (Local)
        LargePhaseOffset: 50000000 (Local)
        SpikeWatchPeriod: 900 (Local)
        LocalClockDispersion: 10 (Local)
        HoldPeriod: 5 (Local)
        PhaseCorrectRate: 1 (Local)
        UpdateInterval: 360000 (Local)
    
    
      
        [TimeProviders]
      
        NtpClient (Local)
        DllName: C:\windows\system32\w32time.dll (Loca
        Enabled: 1 (Local)
        InputProvider: 1 (Local)
        AllowNonstandardModeCombinations: 1 (Local)
        ResolvePeerBackoffMinutes: 15 (Local)
        ResolvePeerBackoffMaxTimes: 7 (Local)
        CompatibilityFlags: 2147483648 (Local)
        EventLogFlags: 1 (Local)
        LargeSampleSkew: 3 (Local)
        SpecialPollInterval: 900 (Local)
        Type: NTP (Local)
        NtpServer: -IP of server-,0x1 (Local)
      
        NtpServer (Local)
        DllName: C:\windows\system32\w32time.dll (Loca
        Enabled: 1 (Local)
        InputProvider: 0 (Local)
        AllowNonstandardModeCombinations: 1 (Local)
    
    
    

    Any ideas?  Thanks in advance.

    Your ESXi server response shows that the leap indicator is 3 and the server stratum is 0.

    This means that ESXi NTP server is synchronized and unable to provide a valid reference time to customers.

    We recommend that you configure your ESXi host with valid upstream NTP servers such as:

    0.vmware.pool.ntp.org,1.vmware.pool.ntp.org and 2. VMware.pool.ntp.org

    as described in the KB article or alternatively your internet service provider NTP servers.

    Although not recommended, you can configure ESXi to allow a reference time by using the own system clock

    If you can not configure ESXi to synchronize to external NTP servers upstream.

    UI, tab Configuration, using software (time setting), properties, Options, and NTP settings.

    Specify "127.127.1.0" as your single NTP server. Don't forget to check the box "restart NTP service to apply the changes.

    then click OK twice to close the dialog boxes. Wait a few minutes for NTP sync, then try your test.

    According to RFC 4330, NTP-SNTP (Simple) customers must not use time in a package of NTP response if the

    stratum returned is 0 (and the leap indicator is 3). Apparently, your client Windows NTP Simple is more

    the RFC.

  • Define information about NTP server using powerCLI

    How can I adjust the settings of the NTP server on a host group ESXi using powerCLI?  I want to set my primary and secondary NTP servers names and them all to have the NTP Server service start by the host.

    Thank you!

    Like this

    Get-VMHost | Add-VMHostNtpServer - NtpServer myntpserver

  • NTP server

    Hello

    I configured in the configuration of time esx server and all the VM are synchronized to the ESX.

    Now, I want to also synchronize Active equipment such as cisco routers to synchronize to the ESX. When I set up the router with the address ESX cisco, cisco does not recognize ESX as an ntp server and the stratum is more than 15 years.

    Also, is it possible to configure the ESX as an NTP server to meet the demand of the ntp? Or it's just for the virtual machine with the virtual machine tools and that's all.

    Thans a lot in advance for your answer.

    Welcome to the forums!

    At least, you must open ports in firewall ESX to accept ntp queries.

    esxcfg-firewall - o 123, udp, in, ntp

    AWo

    VCP 3 & 4

    \[:o]===\[o:]

    = You want to have this ad as a ringtone on your mobile phone? =

    = Send 'Assignment' to 911 for only $999999,99! =

  • Flash Media Server Authentication component software plug-in installation question

    I downloaded the Add-in authentication for use with FME 2.5 and have been unable to install it. I'm trying to install it on my local computer that is running the development version of FMS. If anyone can shed some light it would be great. Thank you

    We have just released a new version of the Add-in to Flash Media Server Authentication for FME 2.5 that works with the release of Flash Media Server relies. You can find it at http://www.adobe.com/go/fme with version 2.5 of FME.

  • Thunderbird 24 pop server authentication

    I use Time Warner Cable (TWC) and Thunderbird (24.4.0) running OS X on a macbook air 10.9.2

    Until about 01:45 east coast U.S. today, I could send and receive on my two accounts in Thunderbird, which all worked fine for the last 2 years 1/2. I can always send and receive emails fine with their web client. I can receive receive in Thunderbird now, but cannot send. The failure of sending began with one account and now affects both.

    At first, I got a message error ro1007005 failed to authenticate to an account, then the other. After

    After more than an hour with TWC we confirmed that my SMTP settings are correct view of TWC as follows

    Server SMTP = mail.twc.com Port = 587 = password, transmitted unsecured way authentication method.

    However, I now get the following:

    Whenever I try to send, I get the following:

    The message send failed.
    The message could not be sent using SMTP server mail.twc.com for some unknown reason. Please check that your SMTP server settings are correct and try again or contact your network administrator.

    Any help would be accepted with gratitude.

    Have you contacted TWC to see if they have some sort of failure?

  • MRI / sealing server / authentication / Active Directory

    Hello

    I want to use 11g "Sealing Server" to unsealing documents.

    Documentation:
    "The current version supports basic HTTP authentication.
    http://download.Oracle.com/docs/CD/E17904_01/user.1111/e12326/isvsealedcontent002.htm#sthref46

    Is it posible to use authentication Windows Active Directory with "sealing Server?


    Thank you.

    Hello

    The authentication scheme supported only for sealing services is basic authentication.

    Kind regards
    Frank.

  • RoboHelp 6 Server authentication

    New construction RoboHelp 6 Client & server on Windows 2003 SP2 server for production (test version worked well on my XP desktop).

    Installation (to start) server and client on the server as well as the control of code Source Robo. Everything works fine (thanks for the missing MFCLOC. Adobe DLL). Can add to source code control, archive, discover, download and generate. Publishing does not work

    WARNING: Impossible to publish on "connection to server {}. reason: cannot log on to the server: {server}. Server does not support any type of authentication method.

    What? All running locally on the server with the same user account, with that I installed.

    Any ideas?

    After running vcredist_x86.exe install missing. DLL as mentioned in previous post and running through this kb: http://kb.adobe.com/selfservice/viewContent.do?externalId=rb_47486&sliceId=2

    Everything works!

Maybe you are looking for