Recently it was brought to my attention to the NTP for our user layer switches wasn't functioning. These use md5 hash configuration.
To troubleshoot, i checked the traffic through our firewall. I was able to see the traffic being passed. Then, i did a capture both at the firewall and was able to confirm in detail that NTP information was flowing between switches and the ntp server as expected to port 123 on UDP. I then selected two switches and preformed a capture on those particular switches uplink interfaces. I was able to confirm that the switches were indeed receiving UDP with a NTP payload.
With that information in mind i double checked the switch NTP config and ran some debug. The IP packet debug confirmed that the switches were sending the packets. NTP debug led me to this:
*Nov 21 11:41:34.685 est: NTP Core (INFO): x.x.xx C01C 8C bad_auth Invalid_NAK
*Nov 21 11:41:34.685 est: NTP Core (ERROR): Invalid-NAK error at 1473700 x.x.x.x<-x.x.x.x
So i reached out to the server admin that runs the NTP server, and we realized the key index was off. We changed it so we were both on the same number key and reset the password to something new and confirmed we were both using the same. We ran a capture again to confirm the switch and server were seeing and sending the new key #.
However we still receive NAK error. I attempted to remove and re-add the key trust command on the XE switch has someone else suggested in a thread, and verifed the clock settings on the switch. The switch is confiqured has such:
ntp authentication-key 3 md5 115808040D401C1F1C6B1A05121302112B 7
ntp authenticate
ntp trusted-key 3
ntp source <mgmt vlan>
ntp server x.x.x.x key 3
ntp server x.x.x.x key 3 maxpoll 10 minpoll 6 version 4 burst iburst
clock timezone est -5 0
clock summer-time edt recurring
Any advice on what we may be missing here would be welcomed. Is there something i am overlooking?
