Confusion regarding no ntp allow mode control command

[will-reynolds-smith]

I am trying to correct an NTP vulnerability on two external Cisco routers and an FTD firepower device.

I was under the belief that the command 'no ntp allow mode control' would prevent mode 6 NTP packets and therefore a DoS attack.

However, I saw some conflicting information stating that the command actually disables the default 3 second delay on NTP control packets and would assist a DoS attack by allowing an uncontrolled flow of packets.

If anyone is able to help me understand what the command no ntp allow mode control actually does that would be great.

[marce1000]

      -  FYI : https://community.cisco.com/t5/network-management/ntp-allow-mode-control/m-p/4602625/highlight/true#M146101

  M.

[will-reynolds-smith]

Thanks. I did see that post but I still would feel better if there is some actual Cisco doco on what that command does, or someone who can confirm it works in the way I believe it to.