NTP synchronization always fails when authenticated

[Chad Westog]

Looking for some assistance...running into some odd behavior with authenticated NTP

NTP synchronization always fails when authenticated

Source: Cisco 4451 and 4331 routers are NTP sources (Running IOS XE 17.6 code)…pulling from public NTP (sync'd stratum 2 & 3)

Clients: Several Cisco 3850 switches (Running IOS XE 16.12/16.9 code)

When no authentication is enabled all devices sync to the two routers (4451 is the preferred)

When I enable ntp authentication nothing sync’s.  All the switches sit at .INIT

When I check show ntp associations detail they all show the following:

x.x.x.x configured, ipv4, authenticated (‘ ‘ reject), insane, invalid, unsynced, stratum 16

rec time xxxxxxxxxxx Mon Jan 1 1900

xmt time xxxxxxxxxxx Mon Jan 1 1900

A soon as I turn off ntp authentication, the switches instantly sync

Validated the ntp keys, cut-n-paste the keys from the same text file

Config Snippet:

Routers (NTP Source)

ntp authentication-key 1 md5 testkey1

ntp authenticate

ntp-trusted-key 1

ntp-server X.X.X.X (Public NTP servers)

ntp-server Y.Y.Y.Y (Public NTP servers)

Switches (NTP Clients)

ntp authentication-key 1 md5 testkey1

ntp authenticate

ntp-trusted-key 1

ntp-server 10.x.255.1 key 1 prefer (4451 loopback)

ntp-server 10.x.255.3 key 1 (4331 loopback)

When I debug on the switches I get the following message: 

NTP Core(INFO): 10.x.255.1 C01C 8C bad_auth no key (16.9 code)

Or

NTP Core(INFO): 10.x.255.1 C01C 8C bad_auth Invalid_NAK (16.12 code)

However I know the keys are there on the routers/switches, again a cut-n-paste from a text file...( I copied from one text editor to a different one in case I had some weird application issue)

Not using any NTP ACL's and the switches can all reach the router loopbacks.  No in-path ACL's blocking access to the routers..again NTP works in a non-authenticated mode.

So I’m wondering do I have bug on the sender (router side) or the receiver (switch side)?

[MHM Cisco World]

ntp authentication-key 1 md5 clear testkey1 <<- add clear in both side and check 
MHM

[Chad Westog]

Invalid input detected...can't put clear and the key.  I can put clear by itself but I'm assuming that the devices are accepting that as the new key

[Georg Pauwen]

Hello,

--> cut-n-paste 

That might be the problem. What if you type in the key manually ?

[Chad Westog]

Manually entered the key string on both sides and still no good...on the switch I was testing with I get the same debug message NTP Core(INFO): 10.x.255.1 C01C 8C bad_auth no key

[Chad Westog]

On a side note I'm starting to lean towards an issue on the switch side, I just pointed a third router (4451 running IOS XE 17.3) I use as a VPN gateway at the two routers and it authenticated with no issue.

show ntp associations detail

10.x.255.3 configured, ipv4, authenticated ('*' sys.peer), authtype (md5), our_master, sane, valid, stratum 3

[MHM Cisco World]

sorry are this issue solve ?
thanks 

[Georg Pauwen]

Hello,

what if you toggle the NTP versions ? 

--> ntp-server 10.x.255.1 key 1 prefer (4451 loopback) version 3/4