Cisco ASR 9000 Series User Manual

The encrypted NTP authentication scheme should be used when a reliable form of access control is required.
Unlike the access-list-based restriction scheme that is based on IP addresses, the encrypted authentication
scheme uses authentication keys and an authentication process to determine if NTP synchronization packets
sent by designated peers or servers on a local network are deemed as trusted, before the time information that
it carries along is accepted.
The authentication process begins from the moment an NTP packet is created. A message authentication code
(MAC) is computed using the MD5 Message Digest Algorithm and the MAC is embedded into an NTP
synchronization packet. The NTP synchronization packet together with the embedded MAC and key number
are transmitted to the receiving client. If authentication is enabled and the key is trusted, the receiving client
computes the MAC in the same way. If the computed MAC matches the embedded MAC, the system is
allowed to sync to the server that uses this key in its packets.
After NTP authentication is properly configured, your networking device only synchronizes with and provides
synchronization to trusted time sources.
SUMMARY STEPS
1.
configure
2.
ntp
3.
authenticate
4.
authentication-key key-number md5 [clear | encrypted] key-name
5.
trusted-key key-number
6.
Use one of the following commands:
•
end
•
commit
DETAILED STEPS
PurposeCommand or Action
configure
Step 1
Enters NTP configuration mode.ntp
Example:
RP/0/RSP0/CPU0:router(config)# ntp
Step 2
Enables the NTP authentication feature.authenticate
Example:
RP/0/RSP0/CPU0:router(config-ntp)#
authenticate
Step 3
Defines the authentication keys.
authentication-key key-number md5 [clear |
encrypted] key-name
Step 4
•
Each key has a key number, a type, a value, and, optionally, a
name. Currently the only key type supported is md5.
Cisco ASR 9000 Series Aggregation Services Router System Management Configuration Guide, Release 5.1.x
216
Implementing NTP
Configuring NTP Authentication

Cisco ASR 9000 Series Specifications

General

Series	ASR 9000
Category	Network Router
Modular Design	Yes
Redundancy	Yes (Hardware and Software)
Operating System	Cisco IOS XR
Interfaces/Ports	10G, 40G, 100G, 400G Ethernet
Expansion Slots	Varies by model
Routing Protocol	BGP, OSPF, IS-IS, EIGRP
Management	CLI, SNMP, NETCONF
Power Supply	Redundant
Port Density	Varies by model
Power Supply Options	AC, DC
Memory	Varies by model
Storage	Varies by model
Dimensions	Varies by model
Weight	Varies by model