How to Configure Cisco Routers only as NTP Client and not as NTP Server?

manoochehr.zangooei · ‎09-26-2015

i have configured a NTP server.and i want to configure cisco routers to only get time from NTP Server.i do not cisco routers to be as a NTP server so that they give time to other systems.
i have configured routers like this:
ntp server x.x.x.x prefer

but the problem is that when i set a router's ip address as ntp for another cisco router , the second router synchronizes it's time from first router that i want to be only a ntp client.
there is another program named ntpquery that can query time from ntp servers.when i configure a router , then the program query the time successfully.it means that the router is configured as ntp server.
how can i set the routers to be only and only a ntp client?

Rolf Fischer · ‎09-26-2015

Hi,

IOS offers a lot of options for hardening NTP.

This document gives a very good overview: Secure NTP Template

Especially the commands 'ntp access-group peer <acl>' and 'ntp access-group serve-only <acl>' shoud be useful to achieve the control you're looking for.

Command Reference: http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/bsm/command/bsm-cr-book/bsm-cr-n1.html#wp5471302810

HTH

Rolf

paul driver · ‎09-26-2015

Hello

NTP server x.x.x.x ( you are pointing to a authorative server and you are the client)

NTP peer x.x.x.x( use this between two devices as they are non authoritive with each other) they will agree on a time.

res

Paul

Please rate and mark as an accepted solution if you have found any of the information provided useful.
This then could assist others on these forums to find a valuable answer and broadens the community’s global network.

Kind Regards
Paul

Rolf Fischer · ‎09-27-2015

Hi Paul,

I agree on your explanations about the ntp peer and ntp server commands, but I don't see how they can be used to restrict time requests without additional configuration (that's how I understand the original question).

Regards

Rolf

paul driver · ‎09-27-2015

Hello Rolf

On their own they dont.

ACLs or client authentication would be applicable approach, as yourself pointed out with the cco doc link

What I was pointing out is:

The server option is for a client to a reliable time source( thus it will be a client only)

The peer option is for a client to client with reliable time sources ( thus it can share its reliable time to other clients)

res

paul

Please rate and mark as an accepted solution if you have found any of the information provided useful.
This then could assist others on these forums to find a valuable answer and broadens the community’s global network.

Kind Regards
Paul