To control access to Network Time Protocol (NTP) services on the system, use the ntp access-group command in global configuration mode. To remove access control to the NTP services, use the no form of this command.

Syntax Description

Command Default

By default, there is no access control. Full access is granted to all systems.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

The access group options are scanned in the following order from the least restrictive to the most restrictive:

1. peer

2. query-only

3. serve

4. serve-only

Access is granted for the first match that is found. If no access groups are specified, comprehensive access is granted to all sources. If you specify any access groups, only the specified access is granted. This facility provides minimal security for the time services of the system. However, it can be circumvented by a determined programmer. For tighter security, use the NTP authentication facility.

The NTP service can be activated by entering any ntp command. When you use the ntp access-group command, the NTP service is activated (if it has not already been activated) and access control to NTP services is configured simultaneously.

When you enter the no ntp access-group command, only the access control to NTP services is removed. The NTP service itself remains active, along with any other previously configured NTP functions.

To disable the NTP service on a device, use the no ntp command without any keywords in global configuration mode. For example, if you want to remove the access control to NTP services, and all NTP functions from the device, use the no ntp command without any keywords.

If you do not specify the ipv4 or ipv6 keyword, the IPv4 access list is configured by default. In Cisco IOS XE Release 3.5S and later releases, the show running-config command displays only the last configured ntp access-group command configured on the router. However, in releases prior to Cisco IOS XE Release 3.5S, the show running-config command displays all ntp access-group commands configured on the router. For example, in Cisco IOS XE Release 3.5S and later releases, if you first configure the ntp access-group serve 1 command and then configure the ntp access-group serve 2 command on the router, the output of the show running-config displays only the ntp access-group serve 1 command, shown below:

Router# configure terminal
Router(config)# ntp access-group serve 2
Router(config)# ntp access-group serve 1
Router(config)# exit
Router# show running-config | include ntp access-group
ntp access-group serve 1
Router#

Related Commands

Note	Effective with Cisco IOS Release 12.2(33)SXJ, the ntp allow mode private command is not available in Cisco IOS software.

To allow the processing of private mode Network Time Protocol (NTP) packets, use the ntp allow mode private command in global configuration mode. To disable the processing of private mode NTP packets, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

By default, the private mode NTP packets are not processed.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

The private mode NTP packets will be blocked if this command is not enabled. If you are using NTP version 4 (NTPv4), you need not configure this command. NTP private mode packet processing is enabled by default in NTPv4.

Related Commands

To enable Network Time Protocol (NTP) authentication, use the ntp authenticate command in the global configuration mode. To disable NTP authentication, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

By default, NTP authentication is not enabled.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Use this command to prevent the system from synchronizing with unauthenticated and unconfigured network peers. This command ensures authentication of packets that are automatically create new temporary, symmetric, broadcast or multicast associations with remote network hosts. If this command is used, when a packet is received from a symmetric, broadcast or multicast association, the system will synchronize with the corresponding peer by checking if the packet carries one of the authentication keys specified in the ntp trusted-key list. Use the ntp trusted-key command to get the list of authentication keys.

You must enable ntp authenticate when enabling the ntp passive, ntp broadcast client, or ntp multicast client commands unless you have other measures (such as using the ntp access-group command) to prevent unauthenticated network attackers from communicating with the device’s NTP daemon.

Use the no ntp authenticate command to allow synchronizing with unauthenticated and unconfigured network peers

The ntp authenticate command does not ensure authentication of peer associations that are created using the ntp server and the ntp peer commands. When creating associations using the ntp server and the ntp peer commands, the key option for the respective commands must be used to ensure the authentication of packets that move to and from the remote peer.

The NTP service can be activated by using any ntp command. Hence, when you use the ntp authenticate command, the NTP service is activated (if it was not already activated) and NTP authentication is enabled simultaneously.

Keywords are optional when you use the no form of any ntp command. When you enter the no ntp authenticate command, the NTP authentication is removed from the NTP service, which remains active with additional functions that you previously configured.

To disable the NTP service on a device, you must enter the no ntp command without any keywords in the global configuration mode. For example, if you previously issued the ntp authenticate command and you now want to disable not only the authentication, but also all NTP functions from the device, use the no ntp command without any keywords. This ensures that all NTP functions are removed and that the NTP service is also disabled.

Related Commands

To define an authentication key for Network Time Protocol (NTP), use the ntp authentication-key command in global configuration mode. To remove the authentication key for NTP, use the no form of this command.

Syntax Description

Command Default

No authentication key is defined for NTP.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Use this command to define authentication keys for use with other NTP commands in order to provide a higher degree of security.

Note	When this command is written to NVRAM, the key is encrypted so that it is not displayed in the configuration.

When you configure the authentication key using the ntp authentication-key command or using the auto secure ntp command, if the length of the MD5 key exceeds 32 characters, an error message is displayed.

The NTP service can be activated by entering any ntp command. When you use the ntp authentication-keycommand, the NTP service is activated (if it has not already been activated) and the NTP authentication key is defined simultaneously.

When you enter the no ntp authentication-keycommand, only the NTP authentication key is removed from the NTP service. The NTP service itself remains active, along with any other previously configured NTP functions.

Note	If a specific authentication key configuration is removed, the NTP process is not stopped until all the authentication key configurations are removed.

To disable the NTP service on a device, use the no ntp command without any keywords in global configuration mode. For example, if you want to remove not only the access control to NTP services, but also all NTP functions from the device, use the no ntp command without any keywords. This ensures that all NTP functions are removed and that the NTP service is also disabled.

Related Commands

To configure the options for broadcasting Network Time Protocol (NTP) traffic, use the ntp broadcast command in interface configuration mode. To disable this capability, use the no form of this command.

Syntax Description

Command Default

NTP broadcasting is disabled.

Command Modes

Interface configuration (config-if)

Command History

Usage Guidelines

The NTP service can be activated by entering any ntp command. When you use the ntp broadcastcommand, the NTP service is activated (if it has not already been activated) and the options are configured for sending NTP traffic simultaneously.

In the no form of any ntp command, all the keywords are optional. When you enter the no ntp broadcastcommand, only the configuration to send NTP broadcast packets on a specified interface is removed from the NTP service. The NTP service itself remains active, along with any other functions that you previously configured.

To disable the NTP service on a device, you must enter the no ntp command without keywords. For example, if you previously issued the ntp broadcast command and you now want to remove not only the broadcast capability, but also all NTP functions from the device, use the no ntp command without any keywords. This ensures that all NTP functions are removed and that the NTP service is also disabled.

Related Commands

To configure a device to receive Network Time Protocol (NTP) broadcast messages on a specified interface, use the ntp broadcast client command in interface configuration mode. To disable this capability, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

By default, an interface is not configured to receive NTP broadcast messages.

Command Modes

Interface configuration (config-if)

Command History

Usage Guidelines

Use this command to allow the system to listen to broadcast packets on an interface-by-interface basis.

The NTP service can be activated by entering any ntp command. When you use the ntp broadcast client command, the NTP service is activated (if it has not already been activated) and the device is configured to receive NTP broadcast packets on a specified interface simultaneously.

In the no form of any ntp command, all the keywords are optional. When you enter the no ntp broadcast client command, only the broadcast client configuration is removed from the NTP service. The NTP service itself remains active, along with any other functions that you previously configured.

To prevent synchronization with unauthorized systems, whenever this command is specified, authentication should be enabled with the ntp authenticate command or access should be restricted to authorized systems using the ntp access-group command.

To disable the NTP service on a device, you must enter the no ntp command without any keywords. For example, if you previously issued the ntp broadcast client command and you now want to remove not only the broadcast client capability, but also all NTP functions from the device, use the no ntp command without any keywords. This ensures that all NTP functions are removed and that the NTP service is also disabled.

In IPv6 configuration, the ntp broadcastdelay command is used when the ntp broadcast client or ntp multicast client command is configured with the novolley keyword.

Related Commands

To set the estimated round-trip delay between the Cisco IOS software and a Network Time Protocol (NTP) broadcast server, use the ntp broadcastdelay command in global configuration mode. To revert to the default value, use the no form of this command.

Syntax Description

Command Default

By default, the round-trip delay between the Cisco IOS software and an NTP broadcast server is 3000 microseconds.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Use the ntp broadcastdelay command when the router is configured as a broadcast client and the round-trip delay on the network is other than 3000 microseconds. In IPv6, the value set by this command should be used only when the ntp broadcast client and ntp multicast client commands have the novolley keyword enabled.

The NTP service can be activated by entering any ntp command. When you use the ntp broadcastdelaycommand, the NTP service is activated (if it has not already been activated) and the estimated round-trip delay between the Cisco IOS software and an NTP broadcast server is set simultaneously.

In the no form of any ntp command, all the keywords are optional. When you enter the no ntp broadcastdelaycommand, only the estimated round-trip delay between the Cisco IOS software and an NTP broadcast server is removed from the NTP service. The NTP service itself remains active, along with any other functions you previously configured.

To disable the NTP service on a device, you must enter the no ntp command without any keywords in global configuration mode. For example, if you previously issued the ntp broadcastdelay command and you now want to remove not only the delay setting, but also all NTP functions from the device, use the no ntp command without any keywords. This ensures that all NTP functions are removed and that the NTP service is also disabled.

Related Commands

To reset the drift value stored in the persistent data file, use the ntp clear driftcommand in privileged EXEC mode.

Syntax Description

This command has no arguments or keywords.

Command Default

The drift value stored in the persistent data file is not reset.

Command Modes

Privileged EXEC (#)

Command History

Usage Guidelines

The ntp clear driftcommand is used to reset the local clock drift value in the persistent data file. The drift is the frequency offset between the local clock hardware and the authoritative time from the Network Time Protocol version 4 (NTPv4) servers. NTPv4 automatically computes this drift and uses it to compensate permanently for local clock imperfections.

This command is available only when the NTP service is activated using any ntp command in global configuration mode.

Related Commands

Caution

Do not use this command; it is documented for informational purposes only. The system automatically generates this command as Network Time Protocol (NTP) determines the clock error and compensates.

Note	Effective with Cisco IOS Release 15.0(1)M, the ntp clock-period command is not available in Cisco IOS software.

As NTP compensates for the error in the software clock, it keeps track of the correction factor for this error. When the value for the clock period needs to be adjusted, the system automatically enters the correct value into the running configuration. To remove the automatically generated value for the clock period, use the no form of this command.

Syntax Description

Command Default

The clock period value is automatically generated.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Do not manually set a value for the NTP clock period.

If the system has automatically entered a value for the clock period into the running configuration, NTP synchronizes faster after the system is restarted when the copy running-config startup-config command has been entered to save the configuration to NVRAM.

The NTP service can be activated by entering any ntp command. In the no form of any ntp command, all the keywords are optional. When you enter the no ntp clock-periodcommand, only the automatically generated value is removed. You should remove this command line when copying configuration files to other devices.The NTP service itself remains active, along with any other functions you previously configured.

To disable the NTP service on a device, you must enter the no ntp command without keywords in global configuration mode. For example, if you want to remove not only the clock period, but all NTP functions from the device, use the no ntp command without any keywords. This ensures that all NTP functions are removed and that the NTP service is also disabled.

To prevent an interface from receiving Network Time Protocol (NTP) packets, use the ntp disable command in interface configuration mode. To enable the receipt of NTP packets on an interface, use the no form of this command.

Syntax Description

Command Default

By default, interfaces receive NTP packets.

Command Modes

Interface configuration (config-if)

Command History

Usage Guidelines

This command provides a simple method of access control.

Use the ntp disable command in interface configuration mode to configure an interface to reject NTP packets. If the ntp disable command is configured on an interface that does not have any NTP service running, the interface remains disabled even after the NTP service is started by another NTP configuration. When you use the ntp disable command without the ip or ipv6 keyword, NTP is disabled on the interface for all the address families.

When you enter the no ntp disablecommand in interface configuration mode, the interface that was configured to reject NTP packets is enabled to receive NTP packets.

Note	Remove all NTP commands from an interface before entering the ntp disable command on that interface.

Configuring the ntp disable command on an interface does not stop the NTP service. To disable the NTP service on a device, use the no ntp command without keywords in global configuration mode. For example, if you had previously issued the ntp disable command and you now want to remove not only this restriction, but also all NTP functions from the device, use the no ntp command without any keywords. This ensures that all NTP functions are removed and that the NTP service is also disabled.

Related Commands

To enable Network Time Protocol (NTP) message logging, use the ntp logging command in global configuration mode. To disable NTP logging, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

NTP message logging is disabled.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Use the ntp logging command to control the display of NTP logging messages.

The NTP service can be activated by entering any ntp command. When you use the ntp loggingcommand, the NTP service is activated (if it has not already been activated) and message logging is enabled simultaneously.

In the no form of any ntp command, all the keywords are optional. When you enter the no ntp loggingcommand, only message logging is disabled in the NTP service. The NTP service itself remains active, along with any other functions that you previously configured.

To disable the NTP service on a device, you must enter the no ntp command without keywords. For example, if you previously issued the ntp logging command and you now want to disable not only the message logging, but also all NTP functions from the device, use the no ntp command without any keywords. This ensures that all NTP functions are removed and that the NTP service is also disabled.

Related Commands

To configure the Cisco IOS software as a Network Time Protocol (NTP) master clock to which peers synchronize themselves when an external NTP source is not available, use the ntp master command in global configuration mode. To disable the master clock function, use the noform of this command.

Syntax Description

Command Default

By default, the master clock function is disabled. When enabled, the default stratum is 8.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Caution

Use this command with caution. Valid time sources can be easily overridden using this command, especially if a low stratum number is configured. Configuring multiple devices in the same network with the ntp master command can cause instability in keeping time if the devices do not agree on the time.

Because the Cisco implementation of NTP does not support directly attached radio or atomic clocks, the router is normally synchronized, directly or indirectly, to an external system that has such a clock. In a network without Internet connectivity, such a time source may not be available. The ntp master command is used in such cases.

A system with the ntp master command configured that cannot reach any clock with a lower stratum number will claim to be synchronized at the configured stratum number, and other systems will be willing to synchronize to it via NTP.

Note	The software clock must have been set from some source, including manual setting, before the ntp master command will have any effect. This protects against distributing erroneous time after the system is restarted.

The NTP service can be activated by entering any ntp command. When you use the ntp mastercommand, the NTP service is activated (if it has not already been activated) and the Cisco IOS software is configured as an NTP master clock simultaneously. When you enter the no ntp master command, only the NTP master clock configuration is removed from the NTP service. The NTP service itself remains active, along with any other functions that you previously configured.

To disable the NTP service on a device, you must enter the no ntp command without any keywords in global configuration mode. For example, if you had previously issued the ntp master command and you now want to remove not only the master clock function, but also all NTP functions from the device, use the no ntp command without any keywords. This ensures that all NTP functions are removed and that the NTP service is also disabled.

Note	Use the ntp master command to configure the Cisco IOS software as a Network Time Protocol (NTP) master clock to which peers synchronize themselves when an external NTP source is not available. When the external NTP source is available again, NTP selects the best router as the NTP master.

Related Commands

To configure the maximum number of Network Time Protocol (NTP) peers for a routing device, use the ntp max-associations command in global configuration mode. To return the maximum associations value to the default, use the no form of this command.

Syntax Description

Command Default

The maximum association value of NTP peers is 100.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

The router can be configured to define the maximum number of NTP peer associations that the router will serve. Use the ntp max-associations command to set the maximum number of NTP peer associations that the router will serve.

The ntp max-associationscommand is useful for ensuring that the router is not overwhelmed by NTP synchronization requests. For an NTP master server, this command is useful for allowing numerous devices to synchronize to a router.

The NTP service can be activated by entering any ntp command. When you use the ntp max-associationscommand, the NTP service is activated (if it has not already been activated) and the maximum number of NTP peers is configured simultaneously.

In the no form of any ntp command, all the keywords are optional. When you enter the no ntp max-associationscommand, only the maximum number value is removed from the NTP service. The NTP service itself remains active, along with any other functions that you previously configured.

To disable the NTP service on a device, you must enter the no ntp command without any keywords in global configuration mode. For example, if you previously issued the ntp max-associationscommand and you now want to remove not only that maximum value, but also all NTP functions from the device, use the no ntp command without any keywords. This ensures that all NTP functions are removed and that the NTP service is also disabled.

Note

By default, the previous configuration values are retained when the last valid configuration (configuration for which the NTP service needs to run) is removed. Only the configuration values related to the maximum number of NTP peer associations are reset to the default value when the NTP process is disabled.

Related Commands

To configure a maximum distance threshold value to govern the number of packets required for synchronization of peers in Network Time Protocol version 4 (NTPv4), use the ntp maxdistance command in global configuration mode. To set the maximum distance threshold to the default value, use the no form of this command.

Syntax Description

Command Default

A maximum distance threshold value of 8 is configured.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Use the ntp maxdistance command to configure the maximum distance threshold for NTPv4. The maximum distance threshold is a selection threshold that is configured for determining the number of packets required for synchronization of Network Time Protocol (NTP) peers.

The number of packets is determined by the synchronization distance for each association and a limit called the distance threshold. The synchronization distance starts at 16, then drops by a factor of about 2 when each packet is received. The default distance threshold is 1. Use the ntp maxdistance command to change the number of packets required.

When you enter the no ntp maxdistance command, only the NTP maxdistance threshold value is reset to the default value. The NTP service itself remains active, along with any other previously configured NTP functions.

If you had issued the ntp maxdistance command and you now want to remove not only this restriction, but also all NTP functions from the device, use the no ntp command without any keywords or arguments.

Note	If you use the no ntp command without any keywords or arguments in global configuration mode, all NTP configurations are removed and the NTP service on the device is disabled.

To configure a system to send Network Time Protocol (NTP) multicast packets on a specified interface, use the ntp multicast command in interface configuration mode. To disable this capability, use the no form of this command.

Syntax Description

Command Default

NTP multicast capability is disabled.

Command Modes

Interface configuration (config-if)

Command History

Usage Guidelines

The TTL value is used to limit the scope of an audience for multicast routing.

The NTP service can be activated by entering any ntp command. When you use the ntp multicastcommand, the NTP service is activated (if it has not already been activated) and the interface on which to send multicast packets is configured simultaneously.

In the no form of any ntp command, all the keywords are optional. When you enter the no ntp multicast command, only the multicast capability is removed from the NTP service. The NTP service itself remains active, along with any other functions that you previously configured.

To disable the NTP service on a device, you must enter the no ntp command in global configuration mode without keywords. For example, if you had previously issued the ntp multicast command and you now want to remove not only the multicast capability, but also all NTP functions from the device, use the no ntp command in global configuration mode without any keywords. This ensures that all NTP functions are removed and that the NTP service is also disabled.

Related Commands

To configure the system to receive Network Time Protocol (NTP) multicast packets on a specified interface, use thentp multicast client command in interface configuration mode. To disable this capability, use the no form of this command.

Syntax Description

Command Default

NTP multicast client capability is disabled.

Command Modes

Interface configuration (config-if)

Command History

Usage Guidelines

Use the ntp multicast client command to allow the system to listen to multicast packets on an interface-by-interface basis.

This command enables the multicast client mode on the local NTP host. In this mode, the host is ready to receive mode 5 (broadcast) NTP messages sent to the specified multicast address. After receiving the first packet, the client measures the nominal propagation delay using a brief client/server association with the server. After this initial phase, the client enters the broadcast client mode, in which it synchronizes its clock to the received multicast messages.

The NTP service can be activated by entering any ntp command. When you use the ntp multicast client command, the NTP service is activated (if it has not already been activated) and the interface on which to receive multicast packets is configured simultaneously.

In the no form of any ntp command, all the keywords are optional. When you enter the no ntp multicast client command, only the multicast client capability is removed from the NTP service. The NTP service itself remains active, along with any other functions that you previously configured.

To prevent synchronization with unauthorized systems, whenever this command is specified, authentication should be enabled with the ntp authenticate command or access should be restricted to authorized systems using the ntp access-group command.

To disable the NTP service on a device, you must enter the no ntp command without any keywords in global configuration mode. For example, if you had previously issued the ntp multicast client command and you now want to remove not only the multicast client capability, but also all NTP functions from the device, use the no ntp command without any keywords. This ensures that all NTP functions are removed and that the NTP service is also disabled.

In IPv6 configuration, the ntp broadcastdelay command is used when the ntp broadcast client or ntp multicast client command is configured with the novolley keyword.

Related Commands

To enable a group of Network Time Protocol (NTP) devices to select one among them to be the simulated Coordinated Universal Time (UTC) source if all real-time clock sources become inaccessible, use the ntp orphan command in global configuration mode. To disable the orphan mode, use the no form of this command.

Syntax Description

Command Default

The orphan mode is set to stratum 0.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

To enable orphan mode in a host, use the ntp orphan command. The value of the stratum argument should be less than 16 and greater than the stratum occurring in the Internet time servers to which the host is connected. Provide an adequate number of available stratums so that every subnet host relying on the orphan children, which are the devices that depend on the the core server that simulates the UTC source, has a stratum that is less than 16. Set the value of the stratum argument to 0 if no association is configured with other servers or reference clocks. Configure the ntp orphan command with the same value for the stratum argument in all the core servers and orphan children. Configure each orphan child with all the root servers.

Related Commands

To configure Network Time Protocol (NTP) to reject time updates greater than the panic threshold of 1000 seconds, use the ntp panic updatecommand in global configuration mode. To disable the configuration, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

NTP is not configured to reject time updates greater than the panic threshold value.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

If the ntp panic update command is configured and the received time updates are greater than the panic threshold of 1000 seconds, the time update is ignored and the following console message is displayed:

NTP Core (ERROR): time correction of -22842. seconds exceeds sanity limit 1000. seconds; set clock manually to the correct UTC time.

Related Commands

To configure passive Network Time Protocol (NTP) associations, use the ntp passive command in global configuration mode. To disable the passive NTP associations, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

By default, passive NTP associations are not configured.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Use the ntp passive command to configure passive NTP associations. By default, passive NTP associations are accepted only when configured using the ntp passive command. Use the no ntp passive command to change the configuration to the default, that is, not to accept passive associations.

The NTP service can be activated by entering any ntp command. When you use the ntp passive command, the NTP service is activated (if it has not already been activated) and the passive NTP associations are configured simultaneously.

When you enter the no ntp passive command, only the passive NTP association configuration is removed from the NTP service. The NTP service itself remains active, along with any other previously configured NTP functions.

To prevent synchronization with unauthorized systems, whenever this command is specified, authentication should be enabled with the ntp authenticate command or access should be restricted to authorized systems using the ntp access-group command.

To disable the NTP service on a device, use the no ntp command without keywords in global configuration mode. For example, if you had previously issued the ntp passive command and you now want to remove not only this restriction, but also all NTP functions from the device, use the no ntp command without any keywords. This ensures that all NTP functions are removed and that the NTP service is also disabled.

Related Commands

To configure a router to allow its software clock to be synchronized with the software clock of a Network Time Protocol (NTP) peer or to allow the software clock of a NTP peer to be synchronized with the software clock of the router, use the ntp peer command in global configuration mode. To disable this capability, use the no form of this command.

Syntax Description

Command Default

The software clock on a router is not configured to synchronize with the NTP peer.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

When a peer is configured, the default NTP version number is 4, no authentication key is used, and the source address is taken from the outgoing interface.

Use this command to allow a device software clock to synchronize with a peer software clock or vice versa. Use the prefer keyword to reduce switching between peers.

If you are using the NTP version 3 (NTPv3) and NTP synchronization does not occur, try using NTP version 2 (NTPv2). For IPv6, use NTP version 4 (NTPv4).

If you select an NTP version that is not supported, a message is displayed.

If you are using NTPv4, the NTP synchronization takes more time to complete when compared to NTPv3, which synchronizes in seconds or within 1 to 2 minutes. The acceptable time for synchronization in NTPv4 is 15 to 20 minutes. The exact time span required for the NTP synchronization while using NTPv4 cannot be derived accurately. It depends on the network topology and complexity. To achieve faster NTP synchronization, enable the burst or iburst mode by using the burst or iburst keyword, respectively. With the burst or iburst mode configured, NTP synchronization takes about 1 to 2 minutes.

Multiple configurations are not allowed for the same peer or server. If a configuration exists for a peer and you use the ntp peer command to configure the same peer, the new configuration will replace the old one.

The NTP service can be activated by entering any ntp command. When you use the ntp peer command, the NTP service is activated (if it has not already been activated) and the NTP peer is configured simultaneously.

When you enter the no ntp peer command, only the NTP peer configuration is removed from the NTP service. The NTP service itself remains active, along with any other previously configured NTP functions.

If you had issued the ntp peer command and you now want to remove not only this restriction, but also all NTP functions from the device, use the no ntp command without any keywords or arguments.

Note	If you use the no ntp command without keywords or arguments in global configuration mode, all NTP configurations are removed and the NTP service on the device is disabled.

Related Commands

To configure an external clock source for use with Network Time Protocol (NTP) services, use the ntp refclock command in line configuration mode. To disable support of the external clock source, use the no form of this command.

Syntax Description

Command Default

By default, an external clock source for use with NTP services is not configured.

Command Modes

Line configuration (config-line)

Command History

Usage Guidelines

To configure a PPS signal as the source for NTP synchronization, use the following form of the ntp refclock command:

ntp refclock trimble pps {cts | ri} [inverted] [pps-offset milliseconds] [stratum number] [timestamp-offset number]

To configure a Trimble Palisade NTP Synchronization Kit as the GPS clock source connected to the auxiliary port of a Cisco 7200 router, use the following form of the ntp refclock command:

ntp refclock trimble pps none [stratum number]

To configure a Telecom Solutions product as the GPS clock source, use the ntp refclock telecom-solutions form of the command:

ntp refclock telecom-solutions pps cts [stratum number]

When two or more servers are configured with the same stratum number, the client will never synchronize with any of the servers. This is because the client is not able to identify the device with which to synchronize. When two or more servers are configured with the same stratum number, and if the client is in synchronization with one of the servers, the synchronization is lost if the settings on one server are changed.

The NTP service can be activated by entering any ntp command. When you use the ntp refclock command, the NTP service is activated (if it has not already been activated) and the external clock source is configured simultaneously.

In the no form of any ntp command, all the keywords are optional. When you enter the no ntp refclock command, only the external clock source is removed from the NTP service. The NTP service itself remains active, along with any other functions that you previously configured.

To terminate the NTP service on a device, you must enter the no ntp command without keywords in global configuration mode. For example, if you had previously issued the ntp refclock command and you now want to remove not only the external clock source, but also all NTP functions from the device, use the no ntp command without any keywords. This ensures that all NTP functions are removed and that the NTP service is also terminated.

Related Commands

To configure a router to allow its software clock to be synchronized with the software clock of a Network Time Protocol (NTP) time server, use the ntp server command in global configuration mode. To disable this capability, use the no form of this command.

Syntax Description

Command Default

No servers are configured by default. When a server is configured, the default NTP version number is 3, an authentication key is not used, and the source IPv4 or IPv6 address is taken from the outgoing interface. Effective with Cisco IOS Release 15.2(1)S1, the burst and the iburst keywords are enabled by default.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Use this command if you want to allow the system to synchronize the system software clock with the specified NTP server.

When you use the hostname argument, the router performs a DNS lookup on that name and stores the IPv4 or IPv6 address in the configuration. For example, if you enter the ntp server hostname command and then check the running configuration, the output shows �ntp server a.b.c.d,� where a.b.c.d is the IP address of the host, assuming that the router is correctly configured as a DNS client.

Use the prefer keyword if you need to use this command multiple times and you want to set a preferred server. Using the prefer keyword reduces switching between servers.

If you are using the default NTP version 3 and NTP synchronization does not occur, try Network TimeProtocol version 2 (NTPv2). Some NTP servers on the Internet run version 2. For IPv6, use NTP version 4 (NTPv4).

If you are using NTPv4, the NTP synchronization takes more time to complete when compared to NTPv3, which synchronizes in seconds or within of 1 to 2 minutes. The acceptable time for synchronization in NTPv4 is 15 to 20 minutes. The exact time span required for the NTP synchronization while using NTPv4 cannot be derived accurately. It depends on the network topology and complexity. To achieve faster NTP synchronization, enable the burst or iburst mode by using the burst or iburst keyword, respectively. With the burst or iburst mode configured, NTP synchronization takes about 1 to 2 minutes.

Note	Effective with Cisco IOS Release 15.2(1)S1, the burst and iburst modes are enabled by default. However, the burst and iburst keywords are retained in the command.

The NTP service can be activated by entering any ntp command. When you use the ntp server command, the NTP service is activated (if it has not already been activated) and software clock synchronization is configured simultaneously.

When you enter the no ntp server command, only the server synchronization capability is removed from the NTP service. The NTP service itself remains active, along with any other previously configured NTP functions.

If you had issued the ntp server command and you now want to remove not only server synchronization capability, but also all NTP functions from the device, use the no ntp command without any keywords or arguments.

Note	If you use the no ntp command without keywords or arguments in global configuration mode, all NTP configurations are removed and the NTP service on the device is disabled.

If you want to disable an NTP server or a peer configured with a particular source interface, you must specify the interface type and number in the no form of the command.

Related Commands

To use a particular source address in Network Time Protocol (NTP) packets, use the ntp source command in global configuration mode. To remove the specified source address, use the no form of this command.

Syntax Description

Command Default

Source address is determined by the outgoing interface.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Use this command when you want to use a particular source IPv4 or IPv6 address for all NTP packets. The address is taken from the named interface. This command is useful if the address on an interface cannot be used as the destination for reply packets. If the source keyword is present on an ntp server or ntp peer global configuration command, that value overrides the global value set by this command.

The NTP service can be activated by entering any ntp command. When you use the ntp source command, the NTP service is activated (if it has not already been activated) and the source address is configured simultaneously.

In the no form of any ntp command, all the keywords are optional. When you enter the no ntp source command, only the source address is removed from the NTP service. The NTP service itself remains active, along with any other functions that you previously configured.

To disable the NTP service on a device, you must enter the no ntp command without any keywords in global configuration mode. For example, if you had previously issued the ntp sourcecommand and you now want to remove not only the configured source address, but also all NTP functions from the device, use the no ntp command without any keywords. This ensures that all NTP functions are removed and that the NTP service is also disabled.

If the NTP source is not set explicitly, and a link fails or an interface state changes, the NTP packets are sourced from the next best interface and the momentarily lost synchronization is regained.

Related Commands

To authenticate the identity of a system to which Network Time Protocol (NTP) will synchronize, use the ntp trusted-key command in global configuration mode. To disable the authentication of the identity of the system, use the no form of this command.

Syntax Description

Command Default

Authentication of the identity of the system is disabled.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

If authentication is enabled, use the ntp trusted-key command to define one or more key numbers (corresponding to the keys defined with the ntp authentication-key command) that a peer NTP system must provide in its NTP packets for synchronization. This authentication function provides protection against accidentally synchronizing the system to another system that is not trusted, because the other system must know the correct authentication key. You can also enter the desired range of key numbers by entering the key-number argument followed by a space and a hyphen (-), and then a space and the end-key-number argument.

The NTP service can be activated by entering any ntp command. When you use the ntp trusted-key command, the NTP service is activated (if it has not already been activated) and the system to which NTP will synchronize is authenticated simultaneously.

In the no form of any ntp command, all the keywords are optional. When you enter the no ntp trusted-key command, only the authentication is disabled in the NTP service. The NTP service itself remains active, along with any other functions that you previously configured.

To disable the NTP service on a device, you must enter the no ntp command without any keywords in global configuration mode. For example, if you had previously issued the ntp trusted-key command and you now want to remove not only the authentication, but also all NTP functions from the device, use the no ntp command without any keywords. This ensures that all NTP functions are removed and that the NTP service is also disabled.

Related Commands

To periodically update the hardware clock (calendar) from a Network Time Protocol (NTP) time source, use the ntp update-calendar command in global configuration mode. To disable the periodic updates, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

The hardware clock (calendar) is not updated.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Some platforms have a battery-powered hardware clock, referred to in the CLI as the calendar, in addition to the software-based system clock. The hardware clock runs continuously, even if the router is powered off or rebooted.

If the software clock is synchronized to an outside time source via NTP, it is a good practice to periodically update the hardware clock with the time learned from NTP. Otherwise, the hardware clock will tend to gradually lose or gain time (drift), and the software clock and hardware clock may lose synchronization with each other. The ntp update-calendar command will enable the hardware clock to be periodically updated with the time specified by the NTP source. The hardware clock will be updated only if NTP has synchronized to an authoritative time server.

Many lower-end routers (for example, the Cisco 2500 series or the Cisco 2600 series) do not have hardware clocks, so this command is not available on those platforms.

To force a single update of the hardware clock from the software clock, use the clock update-calendar command in user EXEC mode.

The NTP service can be activated by entering any ntp command. When you use the ntp update-calendar command, the NTP service is activated (if it has not already been activated) and the hardware clock is updated simultaneously.

In the no form of any ntp command, all the keywords are optional. When you enter the no ntp update-calendar command, only the clock updates are stopped in the NTP service. The NTP service itself remains active, along with any other functions that you previously configured.

To disable the NTP service on a device, you must enter the no ntp command without any keywords in global configuration mode. For example, if you had previously issued the ntp update-calendar command and you now want to disable not only the periodic updates, but also all NTP functions running on the device, use the no ntp command without any keywords. This ensures that all NTP functions are removed and that the NTP service is also disabled.

Related Commands

To display the details of all the buffers that are older than one minute in the system, use the show buffers leakcommand in user EXEC or privileged EXEC mode.

Syntax Description

Command Modes

User EXEC (>)
Privileged EXEC (#)

Command History

Related Commands

To display the details of automatic tuning of buffers, use the show buffers tunecommand in user EXEC or privileged EXEC mode.

Syntax Description

This command has no arguments or keywords.

Command Modes

User EXEC (>)
Privileged EXEC (#)

Command History

Related Commands

To display the details of the buffer usage pattern in a specified buffer pool, use the show buffers usagecommand in user EXEC or privileged EXEC mode.

Syntax Description

Command Modes

User EXEC (>)
Privileged EXEC (#)

Command History

Related Commands

To display the current time and date setting for the hardware clock, use the show calendar command in EXEC mode:

Syntax Description

This command has no arguments or keywords.

Command Modes

EXEC

Command History

Usage Guidelines

Some platforms have a hardware clock (calendar) which is separate from the software clock. The hardware clock is battery operated, and runs continuously, even if the router is powered off or rebooted.

You can compare the time and date shown with this command with the time and date listed via the show clock EXEC command to verify that the hardware clock and software clock are synchronized with each other. The time displayed is relative to the configured time zone.

Related Commands

To display the time and date from the system software clock, use the show clock command in user EXEC or privileged EXEC mode.

Syntax Description

Command Modes

User EXEC
Privileged EXEC

Command History

Usage Guidelines

The software clock keeps an “authoritative” flag that indicates whether the time is authoritative (believed to be accurate). If the software clock has been set by a timing source (for example, via NTP), the flag is set. If the time is not authoritative, it will be used only for display purposes. Until the clock is authoritative and the “authoritative” flag is set, the flag prevents peers from synchronizing to the software clock.

The symbol that precedes the show clock display indicates the following:

These symbols are also used in NTP-based timestamping, such as for syslog (SEM) messages.

Note	In general, NTP synchronization takes approximately 15 to 20 minutes.

Related Commands

To display the status of Network Time Protocol (NTP) associations, use the show ntp associations command in user EXEC or privileged EXEC mode.

Syntax Description

Command Modes

User EXEC (>)

Privileged EXEC (#)

Command History

Related Commands

To display static information about Network Time Protocol (NTP) entities, use the show ntp info command in user EXEC or privileged EXEC mode.

Syntax Description

This command has no arguments or keywords.

Command Modes

Privileged EXEC (#)

User EXEC (>)

Command History

Usage Guidelines

Use the show ntp info command to display static information about the NTP implementation running on the host.

Related Commands

The table below describes the significant fields shown in the display.

Related Commands

To display information about Network Time Protocol (NTP) packets, use the show ntp packets command in user EXEC or privileged EXEC mode.

Syntax Description

Command Modes

User EXEC (>)

Privileged EXEC (#)

Command History

Related Commands

To display the status of the Network Time Protocol (NTP), use the show ntp status command in user EXEC or privileged EXEC mode.

Syntax Description

This command has no arguments or keywords.

Command Modes

User EXEC (>)

Privileged EXEC (#)

Command History

Related Commands

To show information about the Simple Network Time Protocol (SNTP), use the show sntpcommand in EXEC mode on a Cisco 1003, Cisco 1004, Cisco 1005, Cisco 1600, Cisco 1720, or Cisco 1750 router.

Syntax Description

This command has no arguments or keywords.

Command Modes

EXEC

Command History

Related Commands

To display information about configured time ranges, use the show time-range command in user EXEC or privileged EXEC mode.

Syntax Description

This command has no arguments or keywords.

Command Default

This command has no default behavior.

Command Modes

User EXEC and Privileged EXEC

Command History

Usage Guidelines

Use this command to display configured time ranges.

Related Commands

To use the Simple Network Time Protocol (SNTP) to accept Network Time Protocol (NTP) traffic from any broadcast server, use the sntp broadcast clientcommand in global configuration mode to configure a Cisco 1003, Cisco 1004, Cisco 1005, Cisco 1600, Cisco 1720, or Cisco 1750 router. To prevent the router from accepting broadcast traffic, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

The router does not accept SNTP traffic from broadcast servers.

Command Modes

Global configuration

Command History

Usage Guidelines

SNTP is a compact, client-only version of the NTP. SNMP can only receive the time from NTP servers; it cannot be used to provide time services to other systems.

SNTP typically provides time within 100 milliseconds of the accurate time, but it does not provide the complex filtering and statistical mechanisms of NTP. In addition, SNTP does not authenticate traffic, although you can configure extended access lists to provide some protection.

You must configure the router with either this command or the sntp server global configuration command to enable SNTP.

Related Commands

To enable Simple Network Time Protocol (SNTP) message logging, use the sntp logging command in global configuration mode. To disable SNTP logging, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

SNTP message logging is disabled.

Command Modes

Global configuration

Command History

Usage Guidelines

Use the sntp logging command to control the display of SNTP logging messages.

SNTP is a compact, client-only version of Network Time Protocol (NTP). SNTP can be used only to receive the time from NTP servers; SNTP cannot be used to provide time services to other systems. You should consider carefully the use of SNTP rather than NTP in primary servers.

Related Commands

To configure a Cisco 800, Cisco 1003, Cisco 1004, Cisco 1005, Cisco 1600, Cisco 1720, or Cisco 1750 router to use the Simple Network Time Protocol (SNTP) to request and accept Network Time Protocol (NTP) traffic from a stratum 1 time server, use the sntp server command in global configuration mode. To remove a server from the list of NTP servers, use the no form of this command.

Syntax Description

Command Default

The router does not accept SNTP traffic from a time server.

Command Modes

Global configuration

Command History

Usage Guidelines

SNTP is a compact, client-only version of the NTP. SNMP can only receive the time from NTP servers; it cannot be used to provide time services to other systems.

SNTP typically provides time within 100 milliseconds of the accurate time, but it does not provide the complex filtering and statistical mechanisms of NTP. In addition, SNTP does not authenticate traffic, although you can configure extended access lists to provide some protection.

Enter this command once for each NTP server.

You must configure the router with either this command or the sntp broadcast client global configuration command in order to enable SNTP.

SNTP time servers should operate only at the root (stratum 1) of the subnet, and then only in configurations where no other source of synchronization other than a reliable radio or modem time service is available. A stratum 2 server cannot be used as an SNTP time server. The use of SNTP rather than NTP in primary servers should be carefully considered.

Related Commands

To use a particular source address in Simple Network Time Protocol (SNTP) packets, use the sntp source-interface command in global configuration mode. To remove the specified source address, use the no form of this command.