Securing NTP with MD5 Authentication

Bundle lab · $29.99

Configure NTP MD5 authentication so a client (R2) synchronizes only to a trusted, authenticated master (R1). R1 is already an authoritative clock (ntp master 3). You will enable NTP authentication on both routers, define and trust key 1, and bind the key on R2's ntp server statement. Verification focuses on authenticated associations and status; actual time lock may take minutes and is not graded.

Learning objectives

• Secure NTP using MD5 authentication between Cisco IOS routers
• Differentiate required NTP authentication components: authenticate, authentication-key, trusted-key, and keyed server
• Verify authenticated NTP associations and status without relying on full convergence
• Explain why unauthenticated or mismatched keys prevent time sync to block rogue sources

Troubleshooting focus

• Client has ntp server configured but lacks 'ntp authenticate' globally
• Key number mismatch between server and client (e.g., key 1 vs key 2) or untrusted key
• Shared secret differs across devices even if key numbers match
• Wrong server IP or link down—ping the master from the client
• Expect delays before selection; use 'show ntp associations detail' to confirm 'is authenticated'