IntermediatePublished 2026-07-04
Restricting NTP with an access-group
Bundle lab
Lab 6 of 10 in NTP & Network Time · ← Previous · Next →
CCNA exam domain: IP Services
Configure a Cisco IOS router as an authoritative NTP master and restrict which clients it will serve using an NTP access-group with a standard ACL. One shared LAN (no routing) connects three routers through a Layer-2 switch. Only R2 is authorized to receive time from R1; R3 is denied. Learners deploy, verify, and troubleshoot the access-group behavior.
Learning objectives
- Configure an IOS router as an authoritative NTP master with a chosen stratum
- Build a standard ACL to authorize specific NTP clients
- Apply ntp access-group serve-only <acl> to restrict server responses
- Point NTP clients at the master and interpret show ntp associations
- Explain NTP access-group modes: serve, serve-only, peer, query-only
Troubleshooting focus
- NTP client points to wrong server IP or is on a different subnet
- ACL number, type, or ACE is incorrect so all clients are denied
- Using serve instead of serve-only changes behavior and allows peering
- Expecting immediate synchronization; NTP convergence takes time
- Misreading show ntp associations flags or relying on reachability alone
Topology
Subscribe to preview this lab's topology.
See plansGrade your work
How this lab is graded
- Build it your way. Where a lab lets you choose a value — a VLAN name, an interface description — grading checks that you configured it, not which name you picked. Names that another line has to reference, like an ACL applied with
access-class, are stated in the guide and do have to match. - Addresses, modes and protocol keywords are exact. An IP address, a subnet mask,
switchport mode trunk, an encapsulation — these carry the meaning of the lab, so they are graded as written in the guide. - Grading reads your saved configuration. Export the lab from CML after you have configured it, and make sure anything you set is in the
running-config— a change that only exists in a terminal session never reaches the grader. - You can submit as many times as you like. Your best score stands, and each attempt tells you which checks passed so you can work the gaps.
- Scored something you believe is correct? Use Report an issue on this page — that is exactly how the grading fixes in the changelog got found.
Create a free account to submit your lab for grading.
Create a free accountFound a problem with this lab?
Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.