(SINGING) Time keeps on slipping, slipping,
slipping, into the future.
And then NTP steps in and says, not if I can help it.
It's going to be exactly right, no slipping.
In this video, I'd like to remind you about NTP and also
how we can use it with authentication
and also with access control lists
to make it that much more secure.
So let's consider NTP--
Network Time Protocol.
It works on UDP and port number 123
is the well-known port for Network Time Protocol.
And usually we're going to have some type of a really trusted WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And usually we're going to have some type of a really trusted
NTP server that's tied to, like, an atomic clock.
And that type of NTP server that directly
gets its time from an authorized clock,
we refer to that as having a stratum of 1.
And then in our environment, we can have one of our devices,
perhaps Router 1 here, that gets its time from this NTP server.
So it makes requests, gets responses.
And then this would be a stratum 2.
Now, we could also manually configure the routers
to act as a master time server.
We can configure out network devices WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We can configure out network devices
to be either a server, or a client, or a peer.
But having the right time via NTP
is an important part regarding secure network management.
So let's do this.
Let's actually go to Router 1, which I have in my lab.
And let's take a look at its NTP commands and configuration.
And let's walk through how they work.
The first question we can ask this router, Router 1,
is are you synchronized with NTP?
And to do that, we do a show NTP status.
Press Enter.
And right here, if it says synchronized, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And right here, if it says synchronized,
that's a great sign.
And if we do a show NTP associations and press Enter,
it'll tell us who its server is and who it's associated with.
So it's connecting, or it's using 2.2.2.2 as an NTP server.
And then if we did a show run, and I'll do a pipe,
and we'll do include NTP and also a pipe include clock,
they'll show us any output in the running config that
includes the word NTP or the word clock.
So what I chose to do on this system is, because I'm
in the Pacific time zone-- WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
in the Pacific time zone--
I'm in Nevada.
I specified the time zone, which is eight hours off of--
hopefully that's correct-- eight hours off of UTC.
I also specified that we did that whole thing PDT--
Pacific Daylight Savings Time--
recurring.
And in some parts of the world they observe Daylight Savings
Time, other parts they don't.
And even within the United States of America there's some
areas that do and don't.
So maybe someday there won't ever be Daylight Savings Time.
But as long as it's here, we have the commands for it.
I've also set up NTP authenticate,
which means I want to do authentication WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
which means I want to do authentication
with my NTP server.
And as part of that, we set up the NTP authentication key.
Then I put in md5 and a password.
Here it actually put the md5 hash for me.
And then I also specified NTP trusted key and pointed
to that key that I had defined previously.
If I've got some access control lists between me
and the NTP server that are looking and permitting
this traffic, this NTP port 123, only
from certain source addresses, I want
to make sure I'm sourcing it from that address.
So on Router 1, I've got a loopback address of 1.1.1.1 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So on Router 1, I've got a loopback address of 1.1.1.1
that's reachable by the NTP server.
And I'm sourcing all my NTP requests from that.
And I'm also specifying that I should periodically
update my clock calendar on my local router from NTP.
So once I'm synchronized, I can also
synchronize my internal clock.
And then I'm specifying who my server
is, which is server 2.2.2.2.
And if we did a debug of NTP--
and I'll do a question mark, and I'll say all--
that'll give us debug messages regarding NTP.
Now, one thing I want to point out with NTP, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now, one thing I want to point out with NTP,
if you're just setting it up, I would
start off with the basics with no authentication
and make sure it's working.
Then once it's working, then you can go ahead and add onto it
the authentication.
Because one thing I've discovered
is that NTP is the most skeptical protocol ever
on a Cisco router.
So if you enable NTP, and you say here's your server,
it would go, OK.
I want to, like, get a whole bunch of updates
before I start believing that.
And it could take 15 to 20 minutes
before your local router will then synchronize
its clock with the NTP server. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
its clock with the NTP server.
So I point that out so that in a lab environment
or in production, just be aware that it
might take a while for the clock on the local router
to become synchronized.
And there's one more thing I want
to share with you regarding NTP in addition to authentication.
And that is using an access control list
to specify who you're willing to talk to regarding NTP.
And let's go over to the NTP server, which is R2.
And let's turn off debugging there.
Let's do a show access list. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's do a show access list.
So I've got one access list that says permit the source
address of 1.1.1.1, which happens
to be our NTP client, R1.
And if we do a show run pipe include NTP, check this out.
I have this command NTP access group serve 1.
And if we look at the other options for that,
NTP access group and put a question mark there,
so the server represents that we can provide server and query
access.
In case I want to make R1 appear,
I can have server and query access back and forth. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I can have server and query access back and forth.
Or I could do the serve only.
And that means that it would only
act as a server based on that ACL that I'm going to specify.
And the question may come up, well,
why do we need to lock that down?
What's the big deal?
Well, if we are an NTP servers, so we're listening on UDP port
123, an attacker, what would prevent them from just sending,
like, millions and millions of NTP requests and possibly
causing a denial of service or overloading
our service on that router?
So by putting in the access control list specific for NTP,
it's going to go ahead.
And when those packets come in, if they don't match the access WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And when those packets come in, if they don't match the access
list, boom.
They're dropped.
They're not processed.
It can help reduce the chances of a denial of service attack
against our NTP server.
So on this server, if we did a show control--
I think this is supported here-- control plane hosts open ports.
Yeah, right there.
So this guy has port 123 open.
It also has port 23 open for Telnet.
It's also got UDP 4500, in case we're doing NAT traversal.
And it's also got UDP port 500 open.
And that's because this router supports IKE Phase 1. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that's because this router supports IKE Phase 1.
So those are all listening ports.
So the ACL used in conjunction with our NTP statement
is going to help prevent a denial of service attack
against this router.
So thanks for joining me in this video regarding Network Time
Protocol.
And in the next video, I'd like to chat with you
about something very, very critical and important
to the security for network management.
And it is change control.
I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you
and I'd like to thank you for viewing.