A QFX device can act as an NTP server for the network and it can operate in all three modes:- unicast, multicast, and broadcast. This KB explains two possible solutions to make a QFX device work as an NTP server in Multicast mode and also lists down limitations where NTP over multicast does not work on a QFX device

In scenarios with QFX being used as an NTP server and where the end device is operating only in multicast mode, It becomes important to have an NTP server transmitting NTP packets over a multicast group. For NTP over multicast, the reserved group is 224.0.1.1. Network Time Protocol clients listen to this address for protocol messages when operating in multicast mode.  QFX device does not transmit NTP packets over multicast by default which is the case of unicast NTP transmission but for multicast mode, additional configuration is required  on the QFX device

In order to make the QFX device act as an NTP server over multicast it is required to explicitly configure multicast protocols on the device. Below are two methods which can be used to achieve the same.

 
   Below is the topology being used to explain both methods:-
 

   QFX5100[NTP-SERVER]--------------------L2 link---------------------------Client
   [172.24.61.1/24]                                               [172.24.61.23/24]                   

 
The IP address 172.24.61.1/24 is configured on irb.3102 on the QFX device.
An EX switch is being used to simulate the client device for explanation purposes.
 
NOTE:-  Authentication is mandatory for broadcast/multicast mode and this is as per Standards from NTP.org.
Since an intruder can impersonate a broadcast/multicast server and inject false time values, the broadcast/multicast mode should always be cryptographically authenticated. By default, a broadcast association will not be mobilized unless cryptographically authenticated.
 
METHOD-1 :-   By configuring PIM on QFX[NTP SERVER] and client both
 
Below is the required configuration on the QFX device:-
 
 Required PIM configuration:-
 

set protocols pim rp local address 172.24.61.1
set protocols pim interface irb.3102 mode sparse-dense
set protocols pim interface irb.3102 mode sparse-dense

 
 
Required NTP configuration:-
 

set system ntp authentication-key 1 type md5
set system ntp authentication-key 1 value ”$ABC123”
set system ntp server 172.24.61.5
set system ntp broadcast 224.0.1.1 key 1
set system ntp trusted-key 1
set system ntp source-address 172.24.61.1

 
NOTE:-QFX also needs a time source. 172.24.61.5 is acting as the NTP server for the QFX device
 
Below is the reference configuration for the client device[For reference EX device is being used here]
 
PIM:-

set protocols pim rp static address 172.24.61.1
set protocols pim interface irb.3102 mode sparse-dense

 
NTP:-

set system ntp authentication-key 1 type md5
set system ntp authentication-key 1 value ”$ABC123”
set system ntp multicast-client 224.0.1.1
set system ntp trusted-key 1
set system ntp source-address 172.24.61.23

 
Verify if the QFX device is emitting NTP packets:-
 

user@NTP-SERVER> monitor traffic interface irb.3102 no-resolve size 1500 matching "port 123 and host 224.0.1.1"
verbose output suppressed, use <detail> or <extensive> for full protocol decode
Address resolution is OFF.
Listening on irb.3102, capture size 1500 bytes
 
01:19:21.160071 Out IP 172.24.61.1.123 > 224.0.1.1.123: NTPv4, Broadcast, length 68
01:20:25.159322 Out IP 172.24.61.1.123 > 224.0.1.1.123: NTPv4, Broadcast, length 68
01:21:31.160095 Out IP 172.24.61.1.123 > 224.0.1.1.123: NTPv4, Broadcast, length 68
01:22:37.159257 Out IP 172.24.61.1.123 > 224.0.1.1.123: NTPv4, Broadcast, length 68

 
 
Verify if packets are received at the client end:-
 

user@client>monitor traffic interface irb.3102 no-resolve size 1500 matching "port 123 and host 224.0.1.1"   
verbose output suppressed, use <detail> or <extensive> for full protocol decode
Address resolution is OFF.
Listening on irb.3102, capture size 1500 bytes
 
01:19:21.167744  In IP 172.24.61.1.123 > 224.0.1.1.123: NTPv4, Broadcast, length 68
01:20:25.167194  In IP 172.24.61.1.123 > 224.0.1.1.123: NTPv4, Broadcast, length 68
01:21:31.168105  In IP 172.24.61.1.123 > 224.0.1.1.123: NTPv4, Broadcast, length 68
01:22:37.241232  In IP 172.24.61.1.123 > 224.0.1.1.123: NTPv4, Broadcast, length 68
01:23:41.167796  In IP 172.24.61.1.123 > 224.0.1.1.123: NTPv4, Broadcast, length 68
*01:24:45.168156  In IP 172.24.61.1.123 > 224.0.1.1.123: NTPv4, Broadcast, length 68

 
Validate NTP associations at the client end:-
 

user@client>show ntp associations
   remote         refid           st t when poll reach   delay   offset  jitter
===============================================================================
*172.24.61.1      172.24.61.5      6 -  352   64   40   13.449   -1.073  36.660

 
METHOD-2:-   By configuring IGMP and PIM on the QFX. There is no explicit multicast configuration required on the client device for this method.
 
Below is the required configuration on the QFX device:-

IGMP

set protocols igmp interface irb.3102 static group 224.0.1.1

PIM:-
 
set protocols pim rp local address 172.24.61.1
set protocols pim interface irb.3102 mode sparse-dense
 
 
NTP:-
 
set system ntp authentication-key 1 type md5
set system ntp authentication-key 1 value ”$ABC123”
set system ntp server 172.24.61.5
set system ntp broadcast 224.0.1.1 key 1
set system ntp broadcast 224.0.1.1 version 4
set system ntp trusted-key 1
set system ntp source-address 172.24.61.1
 
 

The client device must be enabled to listen for NTP multicast announcements which are sent to multicast group 224.0.1.1
On all Junos devices below configuration is required to enable it as a multicast client for NTP:-

 
set system ntp multicast-client 224.0.1.1
 
 

Additional authentication configuration is required as explained earlier:-

set system ntp authentication-key 1 type md5
set system ntp authentication-key 1 value ”$ABC123”
set system ntp trusted-key 1
set system ntp source-address 172.24.61.23
 
 

Verify if NTP packets are transmitted out from the QFX device:-

 
 
user@NTP-SERVER>monitor traffic interface irb.3102 no-resolve size 1500 matching "port 123 and host 224.0.1.1"
verbose output suppressed, use <detail> or <extensive> for full protocol decode
Address resolution is OFF.
Listening on irb.3102, capture size 1500 bytes
 
01:57:01.159921 Out IP 172.24.61.1.123 > 224.0.1.1.123: NTPv4, Broadcast, length 68
01:58:05.167658 Out IP 172.24.61.1.123 > 224.0.1.1.123: NTPv4, Broadcast, length 68
01:59:11.159402 Out IP 172.24.61.1.123 > 224.0.1.1.123: NTPv4, Broadcast, length 68
02:00:15.168320 Out IP 172.24.61.1.123 > 224.0.1.1.123: NTPv4, Broadcast, length 68
*02:01:19.159409 Out IP 172.24.61.1.123 > 224.0.1.1.123: NTPv4, Broadcast, length 68
 
 
At the client end we can see NTP associations:-
 
 
 
 
user@client>show ntp associations.  
 
   remote         refid           auth st t when poll reach   delay   offset  jitter
 
====================================================================================
 
*172.24.61.1      172.24.61.5     SKEY  6 -  312   64   20   22.239    0.967   7.045
 
 
Limitation:-  When the interface on which PIM and IGMP are enabled on the QFX device[To facilitate the transmission of NTP packets over multicast] is configured within a Routing-instance along with other NTP configurations also using routing instance then NTP over multicast does not work.