Skip to main content
Sign Out

Welcome to Dell

My Account
  • Place orders quickly and easily
  • View orders and track your shipping status
  • Enjoy members-only rewards and discounts
  • Create and access a list of your products
  • Manage your Dell EMC sites, products, and product-level contacts using Company Administration.
Sign In Create an Account Dell Financial Services Premier Sign In Partner Program Sign In
Contact Us

Your Dell.com Carts

Dell Configuration Guide for the S4048–ON System 9.14.2.4

PDF

Configuring NTP Authentication

NTP authentication and the corresponding trusted key provide a reliable means of exchanging NTP packets with trusted time sources.

NTP authentication begins when the first NTP packet is created following the configuration of keys. NTP authentication in Dell EMC Networking OS uses the Message Digest 5 (MD5) or Secure Hash Algorithm 1 (SHA1) algorithm and the key is embedded in the synchronization packet that is sent to an NTP time source.

Dell EMC Networking OS Behavior: Dell EMC Networking OS uses an encryption algorithm to store the authentication key that is different from previous Dell EMC Networking OS versions; Dell EMC Networking OS uses data encryption standard (DES) encryption to store the key in the startup-config when you enter the ntp authentication-key command. Therefore, if your system boots with a startup-configuration from an Dell EMC Networking OS version in which you have configured ntp authentication-key, the system cannot correctly decrypt the key and cannot authenticate the NTP packets. In this case, re-enter this command and save the running-config to the startup-config.

To configure NTP authentication, use the following commands.

  1. Enable NTP authentication.
    CONFIGURATION mode
    ntp authenticate
  2. Set an authentication key.
    CONFIGURATION mode
    ntp authentication-key number {md5 | sha1} key
    Configure the following parameters:
    • number: the range is from 1 to 65534. This number must be the same as the number in the ntp trusted-key command.
    • key: enter a text string. This text string is encrypted.
  3. Define a trusted key.
    CONFIGURATION mode
    ntp trusted-key number
    Configure a number from 1 to 65534.
    The number must be the same as the number used in the ntp authentication-key command.
  4. Configure an NTP server.
    CONFIGURATION mode
    ntp server [vrf] <vrf-name> {hostname | ipv4-address |ipv6-address} [ key keyid] [prefer] [version number][minpoll] [maxpoll]
    Configure the IP address of a server and the following optional parameters:
      • vrf-name : Enter the name of the VRF through which the NTP server is reachable.
      • hostname : Enter the keyword hostname to see the IP address or host name of the remote device.
      • ipv4-address : Enter an IPv4 address in dotted decimal format (A.B.C.D).
      • ipv6-address : Enter an IPv6 address in the format 0000:0000:0000:0000:0000:0000:0000:0000. Elision of zeros is supported.
      • key keyid : Configure a text string as the key exchanged between the NTP server and the client.
      • prefer: Enter the keyword prefer to set this NTP server as the preferred server.
      • version number : Enter a number as the NTP version. The range is from 1 to 4.
      • minpoll polling-interval: Enter the minpoll value. The range is from 4 to 16.
      • maxpoll polling-interval: Enter the maxpoll value. The range is from 4 to 16.
  5. Configure the switch as NTP master.
    CONFIGURATION mode
    ntp master <stratum> 
    To configure the switch as NTP Server use the ntp master<stratum> command. stratum number identifies the NTP Server's hierarchy.

Examples of Configuring and Viewing an NTP Configuration

The following example shows configuring an NTP server.

Dell EMC(conf)#show running-config ntp
!
ntp master
ntp server 10.16.127.44
ntp server 10.16.127.86
ntp server 10.16.127.144
Dell EMC (conf)#
Dell EMC#show ntp associations
   remote       vrf-Id     ref clock     st when poll reach   delay   offset    disp
====================================================================================
 LOCAL(0)        0      .LOCL.           7    7   16    7      0.000    0.000    0.002
 10.16.127.86    0      10.16.127.26     5    3   16    7      0.498  361.760    0.184
 10.16.127.144   0      10.16.127.26     5    1   16    7      0.492  359.171    0.219
 10.16.127.44    0      10.16.127.26     5    5   16    7      0.498  355.501    0.188
* master (synced), # backup, + selected, - outlier, x falseticker 
Dell EMC#
In the above example, the LOCAL (0) determines the following:
  • LOCAL(0) indicates that the local machine synchronizes with itself.
  • .LOCL. indicates reference clock of the NTP master.
NOTE
  • Leap Indicator (sys.leap, peer.leap, pkt.leap) — This is a two-bit code warning of an impending leap second to be inserted in the NTP time scale. The bits are set before 23:59 on the day of insertion and reset after 00:00 on the following day. This causes the number of seconds (rollover interval) in the day of insertion to be increased or decreased by one. In the case of primary servers, the bits are set by operator intervention, while in the case of secondary servers, the bits are set by the protocol. The two bits, bit 0, and bit 1, respectively, are coded as follows:
  • Poll Interval — integer indicating the minimum interval between transmitted messages, in seconds as a power of two. For instance, a value of six indicates a minimum interval of 64 seconds.
  • Precision — integer indicating the precision of the various clocks, in seconds to the nearest power of two. The value must be rounded to the next larger power of two; for instance, a 50 Hz (20 ms) or 60 Hz (16.67ms) power-frequency clock is assigned the value -5 (31.25 ms), while a 1000 Hz (1 ms) crystal-controlled clock is assigned the value -9 (1.95 ms).
  • Root Delay (sys.rootdelay, peer.rootdelay, pkt.rootdelay) — a signed fixed-point number indicating the total round-trip delay to the primary reference source at the root of the synchronization subnet, in seconds. This variable can take on both positive and negative values, depending on clock precision and skew.
  • Root Dispersion (sys.rootdispersion, peer.rootdispersion, pkt.rootdispersion) — a signed fixed-point number indicating the maximum error relative to the primary reference source at the root of the synchronization subnet, in seconds. Only positive values greater than zero are possible.
  • Reference Clock Identifier (sys.refid, peer.refid, pkt.refid) — This is a 32-bit code identifying the particular reference clock. In the case of stratum 0 (unspecified) or stratum 1 (primary reference source), this is a four-octet, left-justified, zero-padded ASCII string, for example: in the case of stratum 2 and greater (secondary reference) this is the four-octet internet address of the peer selected for synchronization.
  • Reference Timestamp (sys.reftime, peer.reftime, pkt.reftime) — This is the local time, in timestamp format, when the local clock was last updated. If the local clock has never been synchronized, the value is zero.
  • Originate Timestamp: The departure time on the server of its last NTP message. If the server becomes unreachable, the value is set to zero.
  • Receive Timestamp — the arrival time on the client of the last NTP message from the server. If the server becomes unreachable, the value is set to zero.
  • Transmit Timestamp — the departure time on the server of the current NTP message from the sender.
  • Filter dispersion — the error in calculating the minimum delay from a set of sample data from a peer.

To view the NTP configuration, use the show running-config ntp command in EXEC privilege mode. The following example shows an encrypted authentication key (in bold). All keys are encrypted.

DellEMC#show running ntp
!
ntp authenticate
ntp authentication-key 345 md5 5A60910F3D211F02
ntp server 11.1.1.1 version 3
ntp trusted-key 345
DellEMC#

Rate this content

Accurate
Useful
Easy to understand
Was this article helpful?
0/3000 characters
  Please provide ratings (1-5 stars).
  Please provide ratings (1-5 stars).
  Please provide ratings (1-5 stars).
  Please select whether the article was helpful or not.
  Comments cannot contain these special characters: <>()\