Thanks rick,

What I was looking for was more to restrict who has access to the router as a time server.

There was a penetration test done and they flagged the edge routers as able to access them and view the information.

The internal routers are not learning from the edge routers, but , maybe the should be?

Should I still use the "peer" "server-only" controls?

Richard

If you need to respond to the results of the penetration test which reported that they could access the edge router then I would think that the ntp access-group serve-only would restrict their access.

As I said, in my experience using just one of the access-group commands can have unintended consequences. So I would advise you to use both. Without knowing more about your network environment it is hard to give good advice. But I believe that it frequently is best to have edge routers learn time from an Internet source and then to have other network devices learn time from the edge router(s). So I would be very inclined to advise that the internal routers should learn time from the edge router. Where are they currently learning time?

HTH

Rick

I appreciate your reply.

There is a router that sits on the edge of the MPLS network that is configured to a differnet external time source than the two edge routers.

This MPLS router is the time source for everything else in the internal network.

The two edge routers are configured separately and nothing is pointing to them.

Richard

It would be ok to just leave the network devices learning time from the MPLS router. But I would suggest that there would be advantages in configuring the internal network devices to have both the edge routers as well as the MPLS router as NTP servers. The main advantage is in providing redundancy. If for some reason the MPLS router lost its sync with its time source the internal network devices would have no source of NTP time. I faced that situation at a customer site a while back. Due to some things going on externally we lost sync with our preferred NTP source and discovered real advantage in having a backup NTP source.

If there are more than 1 NTP servers configured there is an algorithm in NTP tp choose the one to sync with. If you prefer that they continue to use the MPLS router when it is available there is an option in configuring Cisco routers and switches to identify the preferred server.

HTH

Rick

Thanks Rick,

I really appreciate it.

Thanks, it worked like a champ!

Thanks for the reply.

I appreciate this forum very much.

It is very useful to have access to knowledge and experience you all have.

I have learned a great deal here.

I answered a question and have 5 points now, so watch out(actually it was just pointing someone to another post).

Thanks.