Network Time Protocol

Network Time Protocol (NTP) is a widely used protocol used to synchronize the clocks of routers and other devices on the Internet. Primary NTP servers are synchronized to a reference clock directly traceable to the Coordinated Universal Time (UTC). Reference clocks include GPS receivers and telephone modem services. The NTP accuracy expectations depend on the application requirements, but NTP can maintain time to the accuracy of tens of milliseconds over the public internet.

NTP is defined in the RFC 5905: Network Time Protocol Version 4: Protocol and Algorithms Specification. Junos OS may also be configured to accept NTP Version 3, defined in RFC 1305.

Devices running Junos OS can be configured to act as an NTP client, a secondary NTP server, or a primary NTP server. These variations are as follows:

• Primary NTP Server—Primary NTP servers are synchronized to a reference clock that is directly traceable to the UTC. These servers then re-distribute this time data downstream to other Secondary NTP servers or NTP clients.

• Secondary NTP Server—Secondary NTP servers are synchronized to a primary or secondary NTP server. These servers then re-distribute this data downstream to other Secondary NTP servers or NTP clients.

• NTP Client—NTP clients are synchronized to a primary or secondary NTP server. Clients do not re-distribute this time data to other devices.

Note:

The NTP subnet includes several widely accessible public primary time servers which can be used as a network’s primary NTP server. Juniper Networks strongly recommends authentication of each primary server used.

Each device on a network can be configured to run in one or more of the following NTP modes:

• Client/Server Mode—Devices are organized hierarchically across the network in client/server relationships.

• Symmetric Active (peer) Mode—Two or more devices are configured as NTP server peers to provide redundancy.

Note:

NTP must not be used in the broadcast mode or multicast mode in the evaluated configuration.

By default, if an NTP client time drifts so that the difference in time from the NTP server exceeds 128 milliseconds, the NTP client is automatically stepped back into synchronization. The NTP client will still synchronize with the server even if the offset between the NTP client and server exceeds the 1000-second threshold. You can manually request that a device synchronize with an NTP server by using the set date ntp operational command on the router. On devices running Junos OS that have dual Routing Engines, the backup Routing Engine synchronizes directly with the primary Routing Engine.

Each Juniper platform that runs Junos OS supports the leap second adjustment. By default, if the NTP server is aware of the leap second calculations, then the Junos device will automatically add the 1 second delay. PTP (Precision Time Protocol) is used to detect and propagate leap second synchronization changes throughout all nodes in a network. NTP is also required for Common Criteria compliance. For more information on the Common Criteria certification, seePublic Sector Certifications.

For more details about the Network Time Protocol, go to the Network Time Foundation website at http://www.ntp.org.

NTP supports IPv4 VPN and IPv6 routing and forwarding (VRF) requests on Junos OS. VRF request is also supported on Junos OS Release 24.4R1 onwards. This enables an NTP server running on a provider edge (PE) router to respond to NTP requests from a customer edge (CE) router. As a result, a PE router can process any NTP request packet coming from different routing instances.

Note:

The evaluation and certification of the Junos OS does not include TLS. Therefore, Network Time Security (NTS) is also not included. It must not be used in the evaluated configuration. Instead, the NTP messages must be authenticated with a cryptographically secure hash function. SHA-256 is recommended, but SHA-1 is also allowed.

When configuring the NTP, you can specify which system on the network is the authoritative time source, or time server, and how time is synchronized between systems on the network. To do this, you configure the router, switch, or security device to operate in one of the following modes:

• Client mode—In this mode, the local router or switch can be synchronized with the remote system, but the remote system can never be synchronized with the local router or switch.

• Symmetric active mode—In this mode, the local router or switch and the remote system can synchronize with each other. You use this mode in a network in which either the local router or switch or the remote system might be a better source of time.

  Symmetric active mode can be initiated by either the local or the remote system. Only one system needs to be configured to do so. This means that the local system can synchronize with any system that offers symmetric active mode without any configuration whatsoever. However, we strongly encourage you to configure authentication to ensure that the local system synchronizes only with known time servers.

• Server mode—In this mode, the local router or switch operates as an NTP server.

  In NTP server mode, the Junos OS supports authentication as follows:

  • If the NTP request from the client comes with an authentication key (such as a key ID and message digest sent with the packet), the request is processed and answered based on the authentication key match.

  • If the NTP request from the client comes without any authentication key, the request is processed and answered without authentication.

Note:

NTP messages must be authenticated with SHA-256 or SHA-1 in the evaluated configuration.

Note: NTP must not be used in the broadcast mode or multicast mode in the evaluated configuration.

Debugging and troubleshooting are much easier when the timestamps in the log files of all the routers or switches are synchronized, because events that span the network can be correlated with synchronous entries in multiple logs. We strongly recommend using the Network Time Protocol (NTP) to synchronize the system clocks of routers, switches, and other network equipment.

By default, NTP operates in an entirely unauthenticated manner. The following sample configuration synchronizes all the routers or switches in the network to a single time source. The server statement identifies the NTP server used for periodic time synchronization. The authentication-key statement specifies that Secure Hash Algorithm 1 (SHA1) or Secure Hash Algorithm 2 family (SHA-256) scheme to be used for NTP message authentication, preventing the router or switch from synchronizing with an unauthentic time stamp.

Using SHA-256, this is done as follows:

Using SHA-1, this is done as follows:

This example shows how to configure NTP: