NTP Not Authenticating, blocked.

[R_Acuti]

Hi all,

I have configured NTP for authentication. Initially, I had failed to add the key number to the NTP server statements, but I have since fixed that.

BEFORE I added the key to the NTP server statements, all of my routers and switches were synchronized with my NTP servers in an un-authenticated manner.

As soon as I added the key to the NTP server statements, my "test" router immediately lost sync and presented me with:  "UTC:  Authentication key 0"  This seems to indicate that authenticated ntp is blocked?

I can ping from the source to the NTP server. I'm not seeing any denials in my logs for either the source of the NTP server.

Thoughts?

[marce1000]

 - Well for starters, did you correctly configure the NTP key and number in the client configuration; please review the link below thoroughly:

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/5_x/nx-os/system_management/configuration/guide/sm_nx_os_cg/sm_3ntp.html#pgfId-1100303

M.

[R_Acuti]

Sorry for not being clear.  Yes, I've followed that procedure.  I'm in a closed environment and not allowed to post my configs online.  I can redact it a bit...

ntp logging

ntp authentication-key YY md5 XXXXXXXXXXXXXXXXXXXXXXXXXXXX 7

ntp authenticate

ntp server XX.XX.XX.XX key YY

I've placed the identical key on the NTP server. When I run "debug ntp authentication" and watch for authentication attempts, it states that it cannot find key YY.

[marce1000]

 - For the moment , I can only suggest to make sure that the NTP server is not running  a too old software version (IOS/XE); sometimes bugs get fixed in NTP ; check the below link as a 'referenced example' :

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCtt32509/?referring_site=bugquickviewredir

M.

[R_Acuti]

I discovered the problem-

Many online Cisco resources describe the process of configuring NTP, but most of them leave out the final, critical step:  assigning a key number to the NTP server statement. I found that in some separate documentation after much digging.

So in addition to the most commonly known steps, don't forget:

NTP server XX.XX.XX.XX key <number>

In hindsight, it should have been obvious but I'm always smarter in hindsight.