Users may experience synchronization issues with the NTP secondary server IP on the QFX5120 device.

In this article, we will explore the possible causes of the synchronization issue with the secondary server IP

Users with the configuration detailed below may have encountered issues with the NTP server synchronization issue for secondary server IP.

root@qfx> show configuration | display set | match ntp
set system ntp boot-server 10.9.X.X
set system ntp authentication-key 1 type md5
set system ntp authentication-key 1 value "$9$clPyWxaJUkPQmfpBESW8X7-waGPfz/tu.muO1hvMdVwY24.PT/A0Ujp01Rle"
set system ntp authentication-key 2 type md5
set system ntp authentication-key 2 value "$9$XDz-VYjH.F6A24/Atuhc-VbwYoDi.T39QFCu1EeKs2g4Gi.P5n69oaz69A0O"
set system ntp server 10.9.X.X key 1
set system ntp server 10.9.X.X version 4
set system ntp server 10.9.X.X prefer
set system ntp server 10.0.Y.Y key 2
set system ntp server 10.0.Y.Y version 4
set system ntp trusted-key 1
set system ntp trusted-key 2
set system ntp source-address X.X.X.X

In the above configuration customer is using two ntp server IP's 10.9.X.X and 10.0.Y.Y

The customer is faced issue with secondary server IP 10.0.Y.Y Which stuck in Auth status as below.

The synchronization status of the secondary server IP can be verified using the command below.

switch@root> show ntp sassociations 
   remote         refid           st t when poll reach   delay   offset  jitter
===============================================================================
*10.9.X.X     .GNSS.           1 -    -   64    1    0.461    0.305   9.843
 10.0.Y.Y      .AUTH.          16 -    -   64    0    0.000    0.000 4000.00

From the above output we can look the refid to know the NTP server status.

.GNSS.: Indicates the server is synchronized to a GNSS (e.g., GPS) source.
.AUTH.: Indicates that the server is unsynchronized, possibly due to authentication issues.

We can perform the below mentioned steps to have the reachability issue with secondary server IP as below.

Ensure the NTP configuration on the QFX5120 is correct for the secondary server:

Verify that the correct secondary IP address is used and you have the reachability to the secondary IP from the server by verifying via ping test.

Ensure the authentication keys (if any) are configured and match the server and the QFX5120 as below.

We can observe the below mentioned output once the ntp is synchronized for both primary and secondary IP.

switch@root> show ntp associations 
   remote         refid           st t when poll reach   delay   offset  jitter
===============================================================================
*10.9.X.X      .GNSS.           1 -   51   64  177    0.437    0.397   0.055
+10.0.Y.Y      .GNSS.           1 -   51   64  177   14.278   -0.133  10.162

We can see from the above output that both the primary and secondary NTP servers have transitioned to GNSS status, as shown above.