- [Instructor] Now that we've taken a look at
the basics of NTP configuration,
let's dive into securing that NTP operation.
This is going to help prevent us from learning time
from an untrusted source or sending time to somebody
we don't want to send time to.
And there are a couple of ways to secure NTP.
Number one, we can require an authentication key
and we can use that key between
the NTP client and the server.
And secondly, we could use access control lists
to make sure we're getting time from a trusted server
or we're sending time to a trusted client.
Let's set up both options in this video beginning with
how to use an authentication key for NTP.
Let's go over to our internet router
which is acting as our NTP server
and we'll go into global configuration mode
and I'll say ntp authentication hyphen key
and we give a key number here
because we can have more than one a key number.
Notice if I use context-sensitive help that says
this is your key number, I'll just use one.
I'm only going to have one key in this example
and the key is not going to be in clear text
in our configuration, it's going to be an MD5 hash.
So I'll say md5 and then I'll give the key
and I'll say it's going to be dollar sign
three, c, r, e capital T.
So I'm sort of spill that secret
using some different characters.
Now that I have one key defined, I want to say that
that's the key I trust, I have to say which key
or keys are going to be trusted.
To do that I'll say ntp trusted hyphen key
and I give the number and I just have one key
and it's number one.
Now let's say that we're going to require NTP authentication
we'll say ntp authenticate and just to review of a command
we gave in the previous video to make this router
an NTP server, we say ntp master
saying we're going to be serving time from our local clock
which we've already set.
Now we're done on the internet router,
that's our NTP server.
Let's go to the NTP client which is our one
and in global configuration mode,
I need to have a matching key.
The number doesn't have to match but the key has to match
and I'll just use a number one to make it easy.
I'll say ntp authentication hyphen key,
I'll use a key number of one.
Again we're using MD5 hashing and it's going to
be dollar sign three, c, r, e capital T
and we're going to be doing authentication
so I'll say ntp authenticate and I'll say which key
is the trusted key again only have one key in this example
and it's number one,
I'll say ntp trusted hyphen key number one.
And let's point to the server and say
when we're talking to the server
with an IP address of 1.1.1.1,
we're going to be using key number one.
Let's say ntp server key one, oh and I neglected
to put in the IP address of the server,
ntp server 1.1.1.1, key one, there we go.
Now, let's see how to secure NTP using
an access control list, and let's go back to our NTP master
and let's go into global configuration mode
and I'm going to create a standard named access control list.
I'll say IP access hyphen list standard
and I'll call a NTP client and I'm going to identify
the IP address of my client of R1.
Now R1 is using the egress interface going out
to this NTP server and that happens to be
an IP address of 172.16.1.1.
If we're not sure what IP address to use,
we could do a debug NTP packets and we could see
what IP address is being used but in this case
it's the outgoing interface, so I'm going to say
that I want to permit that IP address.
I'll say permit 172.16.1.1
again that's router R1, that's my client.
Now I want to apply this access list to NTP
I'll say ntp access hyphen group and I want
to serve time out to this client,
that's all I want to do with this client.
So I'll say serve only, I don't want to learn time
from this device for example.
And I'll say serve only ntp client
which is the name of my extended access control list
and I'm done on my NTP master or my NTP server.
Let's go back to the client and let's say
that we only trust a time coming
from our NTP server at 1.1.1.1.
Let's go into global configuration mode
and say IP access hyphen a list,
it's going to be a standard access control list
and I'll call it ntp hyphen server
and I want to permit 1.1.1.1 and I want to apply this now
to my NTP configuration.
I'll say ntp access hyphen group
then I'll apply the name of my
standard access control list ntp hyphen server,
Oh and I neglected to give the peer keyword.
Will say peer ntp server
and let's see if we have correct time.
Let's do a show ntp status and yes we do!
It says that we have a stratum of four
because the master is a stratum of three
here's our reference clock.
By the way don't be concerned about
where it says the clock is unsynchronized.
You might think oh we're not really synchronized!
Actually we are but you'll get this clock
is on synchronized message if the root dispersion value
is a little too high and ours is a little too high
because I happen to be running this
on the Cisco VIRL router emulator
and that causes just as a side effect.
it causes the root dispersion value to be high
which causes the clock to say it's unsynchronized
although it really is synchronized.
And that's a look at how we can secure network time protocol
again we had two options.
We could use an authentication key
or we could use an access control list
or as we did in this video, we could use both.