NTP and its access-list

[interfacedy]

Hi, 

NTP server 10.1.1.2 / 10.1.2.2 The client switch has the below configuration. But after adding ntp access-group server-only NTP, the switch become unsynch. Any suggestion? Thanks

Ntp server 10.1.1.2

Ntp server 10.1.2.2 pref

ntp access-group serve-only NTP

ip access-list extended NTP

permit ip host 10.1.1.2 any

permit ip any host 10.1.1.2

permit ip host 10.1.2.2 any

permit ip any host 10.1.2.2

[johnd2310 · Accepted solution]

Hi,

The serve-only keyword means you want "these" clients to get time from your switch. This is not what you want. You want your switch to get time from 10.1.1.2 and 10.1.2.2. You need to user the peer keyword instead of serve-only. Also we normally use a standard access-list for NTP.

Your configuration should be as follows:

• create standard access-list: access-list 1 permit host 10.1.1.2  access-list 1 permit host 10.1.2.2
• create NTP access-group: ntp access-group peer 1
• configure your NTP servers: ntp server 10.1.1.2  ntp server 10.1.2.2

Thanks

John

[interfacedy]

Thank you. is there any difference between standard acl and extended in this case? 

[balaji.bandi · Accepted solution]

not sure what is your goal mentioned in the config :

as i understand the NTP Server running on the Device, you like to restrict only device to allow to use NTP Server then below example should work for you :

ntp access-group peer NTP

or below make it simple :

ntp access-group peer 20
Access-list 20 permit x.x.x.x (these are client device IP)
access-list 20 permit x.x.x.x
access-list 20 deny any log

[interfacedy]

Hi we scan network security vulnerability. It shows some NTP related issue. so we need to block the potential issue. thanks