IP Services · Topic 2 of 9
NTP in Client and Server Mode
See how NTP keeps device clocks in sync, what stratum means, and how to set up an NTP server and client on a Cisco router and verify that it works.
- 4 min
- Exam objective 4.2
- NTP uses UDP port 123.
ntp server IP-ADDRESSmakes a device a client of that server.ntp master STRATUMmakes a device claim to be a time source at that stratum.
What it is
NTP keeps the clocks on network devices in agreement.
It runs over UDP port 123. Logs from different devices are only useful if their timestamps line up. Certificates, authentication tickets and scheduled tasks also depend on correct time.
NTP works as a hierarchy, and each level is a stratum. The number says how many steps a device is from the original time source.
- Stratum 0: the reference clock itself, such as a GPS receiver. It is not a network device.
- Stratum 1: a device connected directly to a stratum 0 source.
- Stratum 2 and up: devices that get time from the level above.
- Stratum 16: the device is not synchronized.
Lower is closer to the source. Stratum on its own does not measure quality, but it shows how far removed a server is.
How it works
A client asks a server for the time and adjusts its own clock to match.
Client mode
Most devices act as clients. The command is ntp server.
ntp server 10.1.1.1A client can have more than one ntp server line. It compares the answers and picks the best source.
Server mode
A device that already learned the time from a better source serves it automatically. A device with no outside source can be made the authority:
ntp master 5The number is the stratum the device claims for itself. The default when you omit it is 8. Clients that sync to it show a stratum one higher.
ntp master hands out the device's own clock even if that clock is wrong. Use it only when you really want that device to be the authority.
With ntp peer, two devices act as symmetric peers and keep each other in sync. Learn the client and server roles first.
Authentication
Authentication makes clients accept time only from trusted sources.
ntp authenticate
ntp authentication-key 1 md5 KEYSTRING
ntp trusted-key 1
ntp server 10.1.1.1 key 1The same key number and string must exist on the server, or the client will not trust it.
Related settings
clock timezonesets the local time zone for display. NTP itself carries UTC.ntp sourcepicks which interface address NTP uses, which helps when the server trusts only one address.
Verifying
show ntp status
show ntp associations
show clock detailshow ntp statussays whether the clock is synchronized, the stratum, and the reference server.show ntp associationslists configured servers. An asterisk marks the one the device synchronized with.show clock detailshows the time and where it came from.
A healthy client shows output like this in show ntp status:
Clock is synchronized, stratum 3, reference is 10.1.1.1Read it left to right. The clock is synchronized, it sits one level below its server, and the server it trusts is 10.1.1.1. If the line says the clock is unsynchronized, the client has not yet found a usable source.
A new client does not sync instantly. Wait a few minutes before you decide something is wrong.
What to remember for the exam
Eight points cover the usual NTP questions.
- NTP uses UDP port 123.
ntp server IP-ADDRESSmakes a device a client of that server.ntp master STRATUMmakes a device claim to be a time source at that stratum.- Stratum counts distance from the reference clock, and lower is closer.
- Stratum 16 means unsynchronized.
show ntp statusandshow ntp associationsare the main checks.- NTP carries UTC, and the local zone is a display setting.
- Accurate time is what makes log timestamps comparable between devices.
Common mistakes
These five slips come up again and again.
Mixing up the two commands. ntp server means "I am a client of this address". ntp master means "I am the source".
Expecting instant sync. The status can look wrong for a while after configuration.
No reachability. NTP is plain UDP. A firewall, an ACL or a missing route that blocks UDP 123 stops it, so test with a ping first.
A wildly wrong starting clock. Set it close with clock set so the first sync is smooth.
Using ntp master everywhere. Several competing masters leave clocks that disagree.
Check yourself
Answer these three before moving on.
What does stratum measure, and what does a stratum of 16 tell you?
Stratum counts how many steps a device is from the reference clock, and lower is closer. Stratum 16 means the device is not synchronized.
What do
ntp serverandntp mastereach tell a router to do?ntp servermakes the router a client of that server address.ntp mastermakes it claim to be a time source at the stratum you give.Which command output shows which server a client chose, and what symbol marks it?
show ntp associationslists the configured servers. An asterisk marks the one the device synchronized with.
Topic 2 of 9 in IP Services
Test yourself on IP Services
The full Cisco CCNA 200-301 question bank has 1,206 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.