NTP authentication protects clients from unauthorized or spoofed servers that could provide incorrect time and disrupt time-sensitive applications and protocols. It verifies that a server is the identity it claims to be before the client synchronizes. section 2.3.3
Configure matching authentication parameters on both NTP devices:
- Create the same key number and password with ntp authentication-key key-number md5 key. section 2.3.3
- Mark the key as usable with ntp trusted-key key-number; creating a key alone is insufficient. section 2.3.3
- On a client, authenticate the server with ntp server ip-address key key-number. section 2.4
- For authenticated NTP peers, apply the same process on both devices and use ntp peer ip-address key key-number. section 2.4
Authenticated NTP server and client
R1(config)# ntp master R1(config)# ntp authentication-key 42 md5 AcingTheCCNA! R1(config)# ntp trusted-key 42 R2(config)# ntp authentication-key 42 md5 AcingTheCCNA! R2(config)# ntp trusted-key 42 R2(config)# ntp server 10.0.0.1 key 42 Both the key number, 42, and the key value must match on R1 and R2. IOS versions may support hashing protocols beyond MD5; context-sensitive help shows available options. section 2.3.3
