Restricting NTP mode 6 queries

[domelro2]

Does anyone know how to restrict NTP mode 6 queries on a Cisco ISR 4431 router? Any help would help appreciated. This is in response to potential UDP-based Amplification attacks.

[Flavio Miranda]

@domelro2 

ip access-list extended NTP

permit ip host 10.1.1.1 any

permit ip any host 10.1.1.1

ntp access-group serve-only NTP

There are a few suggestions to fix this on the forum. 

Solved: NTP and its access-list - Cisco Community

[mike-marquez-ctr]

we added the following to the config and it mitigates the vulnerability :

ntp allow mode control 3

also see this link for more info:

https://community.cisco.com/t5/network-management/ntp-allow-mode-control/td-p/4596164