This article explains that NTP with authentication configured at the global level will send authenticated packets to only one server due to which NTP redundancy may be lost. To prevent this problem, it is recommended that the authentication key should be configured individually on both servers.
In this example scenario, NTP authentication is configured and applied globally and multiple NTP servers are configured.
Non-Working Configuration
user@router# show system ntp Feb 25 13:56:59 boot-server 192.168.1.1; authentication-key 1 type md5 value "$ABC123"; ## SECRET-DATA server 192.168.1.1 server 192.168.10.1 key 1 prefer; ## SECRET-DATA trusted-key 1; source-address 10.10.10.10;
Working Configuration
user@router# show system ntp Feb 25 13:56:59 boot-server 192.168.1.1; authentication-key 1 type md5 value "$ABC123"; ## SECRET-DATA server 192.168.1.1 key 1 prefer; ## SECRET-DATA server 192.168.10.1 key 1 prefer; ## SECRET-DATA trusted-key 1; source-address 10.10.10.10;
Packets are sent with authentication key to only one server as shown below due to which NTP redundancy is lost:
Packet with Authentication
1_withauth.txt Input from: Standard input Output to: 1_withauth.txt.pcap Wrote packet of 110 bytes at 0 Read 1 potential packet, wrote 1 packet Frame 1: 110 bytes on wire (880 bits), 110 bytes captured (880 bits) Arrival Time: Jul 20, 2020 15:25:38.000000000 GMT Epoch Time: 1595238938.000000000 seconds [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 110 bytes (880 bits) Capture Length: 110 bytes (880 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:udp:ntp] Ethernet II, Src: ABC (00:80:ea:cd:65:12), Dst: 20:4e:71:97:da:ac (20:4e:71:97:da:ac) Destination: 20:4e:71:97:da:ac (20:4e:71:97:da:ac) Address: 20:4e:71:97:da:ac (20:4e:71:97:da:ac) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: ABC_cd:65:12 (00:80:ea:cd:65:12) Address: ABC_cd:65:12 (00:80:ea:cd:65:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol Version 4, Src: 10.10.10.10, Dst: 192.168.1.1 Version: 4 Header length: 20 bytes Differentiated Services Field: 0xb8 (DSCP 0x2e: Expedited Forwarding; ECN: 0x00: Not-ECT (Not ECN-Capable Transport)) 1011 10.. = Differentiated Services Codepoint: Expedited Forwarding (0x2e) .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00) Total Length: 96 Identification: 0x01b1 (433) Flags: 0x02 (Don't Fragment) 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (17) Header checksum: 0xc2f9 [correct] [Good: True] [Bad: False] Source: 10.10.10.10 Destination: 192.168.1.1 User Datagram Protocol, Src Port: ntp (123), Dst Port: ntp (123) Source port: ntp (123) Destination port: ntp (123) Length: 76 Checksum: 0xdf5b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Network Time Protocol Flags: 0x24 00.. .... = Leap Indicator: no warning (0) ..10 0... = Version number: NTP Version 4 (4) .... .100 = Mode: server (4) Peer Clock Stratum: primary reference (1) Peer Polling Interval: 6 (64 sec) Peer Clock Precision: 0.000000 sec Root Delay: 0.0000 sec Root Dispersion: 0.0000 sec Reference ID: Global Position System Reference Timestamp: Mar 23, 2020 09:48:03.000000000 UTC Origin Timestamp: Mar 23, 2020 09:48:03.145369000 UTC Receive Timestamp: Mar 23, 2020 09:48:03.145213000 UTC Transmit Timestamp: Mar 23, 2020 09:51:18.518824000 UTC Key ID: 00000001 Message Authentication Code: 02701263302d8436cb0e20cafadf6fce >>>> Authentication available
Packet Without Authentication
1_withoutauth.txt Input from: Standard input Output to: 1_withoutauth.txt.pcap Wrote packet of 90 bytes at 0 Read 1 potential packet, wrote 1 packet Frame 1: 90 bytes on wire (720 bits), 90 bytes captured (720 bits) Arrival Time: Jul 20, 2020 15:25:13.000000000 GMT Epoch Time: 1595238913.000000000 seconds [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 90 bytes (720 bits) Capture Length: 90 bytes (720 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:udp:ntp] Ethernet II, Src: ABC (00:80:ea:cd:65:12), Dst: 20:4e:71:97:da:ac (20:4e:71:97:da:ac) Destination: 20:4e:71:97:da:ac (20:4e:71:97:da:ac) Address: 20:4e:71:97:da:ac (20:4e:71:97:da:ac) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: ABC_cd:65:12 (00:80:ea:cd:65:12) Address: ABC_cd:65:12 (00:80:ea:cd:65:12) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol Version 4, Src: 10.10.10.10 Dst: 192.168.1.1 Version: 4 Header length: 20 bytes Differentiated Services Field: 0xb8 (DSCP 0x2e: Expedited Forwarding; ECN: 0x00: Not-ECT (Not ECN-Capable Transport)) 1011 10.. = Differentiated Services Codepoint: Expedited Forwarding (0x2e) .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00) Total Length: 76 Identification: 0xf4f0 (62704) Flags: 0x02 (Don't Fragment) 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (17) Header checksum: 0xcfcd [correct] [Good: True] [Bad: False] Source: 10.10.10.10 Destination: 192.168.1.1 User Datagram Protocol, Src Port: ntp (123), Dst Port: ntp (123) Source port: ntp (123) Destination port: ntp (123) Length: 56 Checksum: 0x0000 (none) [Good Checksum: False] [Bad Checksum: False] Network Time Protocol Flags: 0x24 00.. .... = Leap Indicator: no warning (0) ..10 0... = Version number: NTP Version 4 (4) .... .100 = Mode: server (4) Peer Clock Stratum: primary reference (1) Peer Polling Interval: 6 (64 sec) Peer Clock Precision: 0.000000 sec Root Delay: 0.0000 sec Root Dispersion: 0.0000 sec Reference ID: Global Position System Reference Timestamp: Mar 23, 2020 09:20:57.000000000 UTC Origin Timestamp: Mar 23, 2020 09:20:57.872406000 UTC Receive Timestamp: Mar 23, 2020 09:20:57.871554000 UTC Transmit Timestamp: Mar 23, 2020 09:20:57.872070000 UTC >>>> No authentication field which causes the problem
Configure key individually on both NTP servers. Refer to Configuring the NTP Time Server and Time Services and Configuring NTP Authentication Keys for more details.