topic NTP Not Authenticating, blocked. in Network Management

NTP Not Authenticating, blocked.

R_Acuti — Sat, 02 Mar 2019 02:27:12 GMT

Hi all,

I have configured NTP for authentication. Initially, I had failed to add the key number to the NTP server statements, but I have since fixed that.

BEFORE I added the key to the NTP server statements, all of my routers and switches were synchronized with my NTP servers in an un-authenticated manner.

As soon as I added the key to the NTP server statements, my "test" router immediately lost sync and presented me with: "UTC: Authentication key 0" This seems to indicate that authenticated ntp is blocked?

I can ping from the source to the NTP server. I'm not seeing any denials in my logs for either the source of the NTP server.

Thoughts?

Re: NTP Not Authenticating, blocked.

marce1000 — Fri, 09 Mar 2018 16:22:38 GMT

- Well for starters, did you correctly configure the NTP key and number in the client configuration; please review the link below thoroughly:

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/5_x/nx-os/system_management/configuration/guide/sm_nx_os_cg/sm_3ntp.html#pgfId-1100303

Re: NTP Not Authenticating, blocked.

R_Acuti — Fri, 09 Mar 2018 17:18:32 GMT

Sorry for not being clear. Yes, I've followed that procedure. I'm in a closed environment and not allowed to post my configs online. I can redact it a bit...

ntp logging

ntp authentication-key YY md5 XXXXXXXXXXXXXXXXXXXXXXXXXXXX 7

ntp authenticate

ntp server XX.XX.XX.XX key YY

I've placed the identical key on the NTP server. When I run "debug ntp authentication" and watch for authentication attempts, it states that it cannot find key YY.

Re: NTP Not Authenticating, blocked.

marce1000 — Sat, 10 Mar 2018 06:23:22 GMT

- For the moment , I can only suggest to make sure that the NTP server is not running a too old software version (IOS/XE); sometimes bugs get fixed in NTP ; check the below link as a 'referenced example' :

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCtt32509/?referring_site=bugquickviewredir

Re: NTP Not Authenticating, blocked.

R_Acuti — Fri, 23 Mar 2018 11:12:52 GMT

I discovered the problem-

Many online Cisco resources describe the process of configuring NTP, but most of them leave out the final, critical step: assigning a key number to the NTP server statement. I found that in some separate documentation after much digging.

So in addition to the most commonly known steps, don't forget:

NTP server XX.XX.XX.XX key <number>

In hindsight, it should have been obvious but I'm always smarter in hindsight.