Understand NTP Association Codes in SD-WAN Controllers

Introduction

This document describes how to understand NTP association status codes on SD-WAN controllers.

Prerequisites

• NTP service must be allowed allow-service ntp inside of VPN 0 tunnel interfaces of all controllers. If the service is not allowed, use this procedure to enable it.
  
  

config t
vpn 0
!
interface eth1 
tunnel-interface 
allow-service ntp 
!
commit

• All controllers must also have NTP configured. Consult the official documentation to configure NTP via CLI or vManage Template.
• All controllers and all nodes in the overlay must be configured with the same NTP server to have the same date/hour. Different date/hour set can cause issues in control connection establishment.

Note: For NTP configuration see Configure NTP servers Using Cisco Vmanage and Configure NTP using CLI.

Note: For additional reference about control connection establishment issues refer to Troubleshoot SD-WAN Control Connections.

Components Used

This document is based on these software and hardware versions:

• SD-WAN controllers version 20.9.3

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

SD-WAN Controllers can be associated to a Network Time Protocol (NTP) server for network clock synchronization. NTP is built on the User Datagram Protocol (UDP) port 13 which provides a connectionless transport method.

In Viptela OS, show ntp associations command displays different codes during the connection process that provides information about the stage the synchronization is on. That can be used to know the status or troubleshoot potential issues.

Problem

NTP association status can show different values that help to find the root cause out of NTP issues, but still need a human readable interpretation.

Scenario 1: NTP connectivity is successfully established, code is 961a.

vBond1# show ntp associations
                                                    LAST
IDX ASSOCID STATUS CONF REACHABILITY AUTH CONDITION EVENT COUNT
-----------------------------------------------------------------------------
1   42171   961a    yes yes          none sys.peer reachable 1

Scenario 2: NTP connectivity is not established, code is 8023.

vManage# show ntp associations
                                                    LAST
IDX ASSOCID STATUS CONF REACHABILITY AUTH CONDITION EVENT COUNT
----------------------------------------------------------------------------
1   14598   8023   yes   no          none reject mobilize 1

Solution

Code Interpretation

With these codes obtained from scenarios 1 and 2, information can be translated into human readable information.

• Decode first byte:
   
  • Scenario 1: From the obtained code 961a, the first byte 9 means 10+80 (reachable and configured in ntp.conf).
  • Scenario 2: From the obtained code 8023, the first byte 8 means that NTP server is configured but not reachable.

• Decode second byte: 
   
  • Scenario 1: From the obtained code 961a, the second byte 6 means that it is the system peer.
  • Scenario 2: From the obtained code 8023, the second byte 0 means that is discarded as not valid.
    
    

• Decode third and fourth byte: Third byte is the count of times that fourth byte has ocurred.
  
  
  • Scenario 1: From the obtained code 961a, third and fourth bytes 1a mean that device has become system peer once.
  • Scenario 2: From the obtained code 8023 , third and fourth bytes 23 mean that NTP is configured, not reachable, discarded as not valid and there have been two attempts to reach it with no success.
    
    

Note: For further reference about NTP association codes, refer to RFC5905.

Conclusions

• Code 961a from scenario 1 means that:
   
  • NTP server is reachable and configured in ntp.conf (byte 9).
  • It is a system peer (byte 6).
  • Has became system peer once (byte 1 and byte a).

• Code 8023 from scenario 2 means that:
  
  
  • NTP server is configured but it is not reachable (byte 8).
  • This means that is discarded as not valid (byte 0).
  • This means that NTP is configured, not reachable, discarded as not valid, and there have been two attempts to reach it with no success. (byte 2 and byte 3).

Useful Commands

These commands  can be used for NTP troubleshoot purposes in addition to show ntp associations.

• show ntp peer: Display information about the NTP peers with which the Cisco SD-WAN software is synchronizing its clocks.
• tcpdump test: Tcpdump test is useful to confirm that there are packets being sent and received between the controllers and the NTP server.