[ Contents] [ Prev] [ Next] [ Index] [ Report an Error]

Synchronizing and Coordinating Time Distribution Using NTP

Using NTP to synchronize and coordinate time distribution in a large network involves these tasks:

  1. Configuring NTP
  2. Configuring the NTP Boot Server
  3. Specifying a Source Address for an NTP Server

Configuring NTP

To configure NTP on the router, include the ntp statement at the [edit system] hierarchy level:

[edit system]
ntp {
authentication-key number type type value password;
boot-server address;
broadcast <address> <key key-number> <version value> <ttl value>;
broadcast-client;
multicast-client <address>;
peer address <key key-number> <version value> <prefer>;
server address <key key-number> <version value> <prefer>;
source-address source-address;
trusted-key [ key-numbers ];
}

Configuring the NTP Boot Server

When you boot the router, it issues an ntpdate request, which polls a network server to determine the local date and time. You need to configure a server that the router uses to determine the time when the router boots. Otherwise, NTP will not be able to synchronize to a time server if the server’s time appears to be very far off of the local router’s time.

To configure the NTP boot server, include the boot-server statement at the [edit system ntp] hierarchy level:

[edit system ntp]
boot-server address;

Specify the address of the network server. You must specify an address, not a hostname.

Specifying a Source Address for an NTP Server

For IP version 4 (IPv4), you can specify that if the NTP server configured at the [edit system ntp] hierarchy level is contacted on one of the loopback interface addresses, the reply always uses a specific source address. This is useful for controlling which source address NTP will use to access your network when it is either responding to an NTP client request from your network or when it itself is sending NTP requests to your network.

To configure the specific source address that the reply will always use, and the source address that requests initiated by NTP server will use, include the source-address statement at the [edit system ntp] hierarchy level:

[edit system ntp]
source-address source-address;

source-address is a valid IP address configured on one of the router interfaces.

Note: If a firewall filter is applied on the loopback interface, ensure that the source-address specified for the NTP server at the [edit system ntp] hierarchy level is explicitly included as one of the match criteria in the firewall filter. This enables the JUNOS Software to accept traffic on the loopback interface from the specified source address.

The following example shows a firewall filter with the source address 10.0.10.100 specified in the from statement included at the [edit firewall filter firewall-filter-name] hierarchy:

[edit firewall filter Loopback-Interface-Firewall-Filter]
term Allow-NTP {
from {
source-address {
172.17.27.46/32; // IP address of the NTP server
10.0.10.100/32; // Source address specified for the NTP server
}
then accept;
}
}

If no source-address is configured for the NTP server, include the primary address of the loopback interface in the firewall filter.

Related Topics

[ Contents] [ Prev] [ Next] [ Index] [ Report an Error]