How to add SHA 256 NTP Authentication key.

[Zee-Far-Man]

Hello Pros,

we have 5 2960x, ,  with the latest STIG released on last Wednesday.  we need to update the NTP authentication to now use SHA-256.     

The current IOS is running is C2960X-UNIVERSALK9-M 

I was trying to add 

(config)#ntp authentication-key 1 hmac-sha2-256 HEX:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx. The 2960x switch is accepting sha2-256 key.

1. Does (C2960X-UNIVERSALK9-M) IOS support/accept SHA2-256 key? if not then which IOS version do I have to upgrade with??

Thanks, in advanced.

[Rob Ingram]

@Zee-Far-Man unfortunately it seems neither SHA-256 nor SHA appear to be supported for NTP currently - https://www.cisco.com/c/en/us/support/docs/ip/access-lists/13608-21.html

https://www.cisco.com/c/en/us/td/docs/routers/ios/config/17-x/syst-mgmt/b-system-management/m_bsm-time-calendar-set.html

only MD5 is supported.

[vishalbhandari · Accepted solution]

@Zee-Far-Man 

The Cisco 2960X running the C2960X-UNIVERSALK9-M IOS does not support SHA-256 for NTP authentication. It only supports MD5 for NTP authentication keys. Unfortunately, there's no IOS version for the 2960X that adds support for SHA-256, as this feature is not available on the hardware platform. If SHA-256 is a strict STIG requirement, you may need to consider upgrading to a newer switch model, like the Catalyst 9200 or 9300, which support SHA-256 with the appropriate IOS XE versions

[Zee-Far-Man · Accepted solution]

@vishalbhandari 

That's what I was thinking too.  I tried to add SHA-256 Key to one of 9200 switch and it worked but not on C2960x model.

Thank you all Pros for your time and assistance.