ntp authentication fails

Answered Question
Oct 3rd, 2009
User Badges:

Hello,


NTP authentication is supposed to be simple, but not really....


I suspect it could be an IOS issue because when I enable NTP on a Catalyst 6509 (s72033_rp-IPSERVICESK9_WAN-M), Version 12.2(33)SXI1) with NTP authentication and configure another 6509 client to autenticate against the master everything works fine (VSS enabled switches.


But when I try to do the same thing fram a catalyst 6513 (s72033_rp-IPSERVICESK9-M), Version 12.2(18)SXF11) without VSS, authentication and synchronisation fails.


When I disable NTP authentication synchronisation works fine.


I'm very sure I used the right key, in fact I entered it manually, and tried to copy the ntp config from a VSS enabled switch.


But both failed, below is my config and debug output:


VSS Switch:

aaa accounting session-duration ntp-adjusted

ntp authentication-key 123 md5 secret

ntp authenticate

ntp trusted-key 123

ntp clock-period 17179785

ntp update-calendar

ntp server 10.57.66.1 key 123

ntp server 10.56.69.11


Cat 6513 switch:

ntp authentication-key 123 md5 secret

ntp authenticate

ntp trusted-key 123

ntp clock-period 17179979

ntp server 10.65.66.2 key 123

ntp server 10.56.66.1 key 123

ntp server 10.57.66.1 key 123



debug output 6513:

.Oct 3 16:27:01.489: NTP: xmit packet to 10.57.66.1:

.Oct 3 16:27:01.489: leap 3, mode 3, version 3, stratum 0, ppoll 64

.Oct 3 16:27:01.489: rtdel 05CC (22.644), rtdsp 0A9A (41.412), refid 0A384201 (10.56.66.1)

.Oct 3 16:27:01.489: ref CE7074F5.F2F51935 (14:47:49.949 CEST Fri Oct 2 2009)

.Oct 3 16:27:01.489: org CE71DD75.C6F22C40 (16:25:57.777 CEST Sat Oct 3 2009)

.Oct 3 16:27:01.489: rec CE71DD75.7DB8D2FC (16:25:57.491 CEST Sat Oct 3 2009)

.Oct 3 16:27:01.489: xmt CE71DDB5.7D665F74 (16:27:01.489 CEST Sat Oct 3 2009)

.Oct 3 16:27:01.489: Authentication key 123

.Oct 3 16:27:01.489: NTP: rcv packet from 10.57.66.1 to 10.10.2.89 on Vlan13:

.Oct 3 16:27:01.489: leap 0, mode 4, version 3, stratum 4, ppoll 64

.Oct 3 16:27:01.489: rtdel 0164 (5.432), rtdsp 0726 (27.924), refid 0A39450B (10.57.69.11)

.Oct 3 16:27:01.489: ref CE71DBAB.7BFDECCA (16:18:19.484 CEST Sat Oct 3 2009)

.Oct 3 16:27:01.489: org CE71DDB5.7D665F74 (16:27:01.489 CEST Sat Oct 3 2009)

.Oct 3 16:27:01.489: rec CE71DDB5.C70E2DBB (16:27:01.777 CEST Sat Oct 3 2009)

.Oct 3 16:27:01.489: xmt CE71DDB5.C71A3DD9 (16:27:01.777 CEST Sat Oct 3 2009)

.Oct 3 16:27:01.489: inp CE71DDB5.7DDB0D72 (16:27:01.491 CEST Sat Oct 3 2009)

.Oct 3 16:27:01.489: Authentication key 0term no



Could someone please help

Correct Answer by Richard Burts about 7 years 9 months ago

O.A.


Thank you for posting back to the forum and confirming that the problem here is confirmed as an IOS bug. It helps make the forum more useful when people can read about a problem and can know what the outcome of the problem is. Perhaps you can use the check mark to indicate that the problem is resolved and this might help users of the forum to know that this is a solved problem.


HTH


Rick

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 3 (2 ratings)
Loading.
Lucien Avramov Sat, 10/03/2009 - 08:06
User Badges:
  • Red, 2250 points or more

Can you attach more debugs:

debug ntp auth

debug ntp sync

debug ntp events

debug ntp packet

debug ntp sync


Richard Burts Sat, 10/03/2009 - 17:33
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

O.A.


There is some ambiguity in your explanation. You say:"in fact I entered it manually, and tried to copy the ntp config from a VSS enabled switch". My question is: did you enter the NTP authentication key manually, or did you copy it from the working configuration?


I am not sure why Cisco did it this way, but a copy of the confiuration (including the authentication key) from a working config to a new config will insert an invalid key into the new config. The only way to get it to work properly is to manually configure the new authentication key in the new config.


HTH


Rick

orsonjoon Fri, 10/09/2009 - 04:24
User Badges:

Cisco TAC confirmed this as an IOS bug, so further troubleshooting isn't nessecary. An upgrade would fix the problem.

Correct Answer
Richard Burts Fri, 10/09/2009 - 04:27
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

O.A.


Thank you for posting back to the forum and confirming that the problem here is confirmed as an IOS bug. It helps make the forum more useful when people can read about a problem and can know what the outcome of the problem is. Perhaps you can use the check mark to indicate that the problem is resolved and this might help users of the forum to know that this is a solved problem.


HTH


Rick

iyde Sat, 10/10/2009 - 01:12
User Badges:
  • Silver, 250 points or more

Hi.

Would it be possible to have the bug id as well?

Thanks.

Lucien Avramov Sat, 10/10/2009 - 10:32
User Badges:
  • Red, 2250 points or more

There is no bug on this train yet related to NTP, I checked.

I assume TAC is still doing initial review and probably asking for the same debugs I asked in this post.


Cant really troubleshoot this if there are no debugs sent.



orsonjoon Mon, 10/19/2009 - 23:21
User Badges:

As this is still under investigation at TAC, no further actions from my side will be taken on the forum to resolve this issue.


This is a part of one of the replies I got from the TAC engineer:


"I did check a couple of cases with similar issue where they were having SXF11 also and NTP was not working. IOS upgrade fixed the issue and NTP started working again.


It is strange and if it is working without authentication and not with even when we configured it again manually it looks like it may be due to some bug. IOS upgrade would fix the issue however if you can send me the debugs I asked for we can have someone look into the IOS code and get it fixed."




Actions

This Discussion