Cisco IOS NTP Configuration: Server and Source Interface

Accurate time on network gear is not cosmetic: syslog correlation, RADIUS/TACACS authentication, certificate validation, SNMP time stamps and routing protocol debugging all depend on synchronized clocks. Cisco IOS and IOS XE routers and switches use NTP associations to keep time, and while the configuration is short, the details matter - especially the source interface, which decides which IP address the device advertises as its NTP source. This guide walks through the standard Cisco IOS NTP configuration with the commands that make it reliable in production.

Configuring NTP Servers

Point the device at one or more upstream NTP servers from global configuration mode. Use the prefer keyword to mark your most authoritative or closest server; Cisco then prefers that server among the valid associations:

Router(config)# ntp server 203.0.113.1 prefer
Router(config)# ntp server 203.0.113.2
Router(config)# ntp server 2001:db8::1

On platforms with a dedicated management VRF, bind the NTP association to that VRF so time sync does not depend on the production routing table:

Router(config)# ntp server vrf Mgmt-vrf 203.0.113.1 prefer

Setting the NTP Source Interface

The source interface determines the IP address in the NTP packets and, more importantly, which address the server and other peers reply to. Loopbacks are the usual choice because they stay up regardless of WAN link state:

Router(config)# ntp source Loopback0

Without an explicit source, the router uses the outgoing interface address, which can change after routing changes and break NTP access lists or server-side restrictions.

Optional: NTP Authentication

In environments where an attacker could spoof NTP, enable symmetric-key authentication and trust only known keys:

Router(config)# ntp authenticate
Router(config)# ntp authentication-key 1 md5 Sup3rSecretKey
Router(config)# ntp trusted-key 1
Router(config)# ntp server 203.0.113.1 key 1

Verifying NTP Synchronization

Confirm that the device has synchronized and check each association:

Router# show ntp status
Router# show ntp associations

A healthy device shows Clock is synchronized with a stratum number one higher than its server, and the association list marks the preferred peer with an asterisk or a synchronized state. If the clock stays unsynchronized, check UDP port 123 reachability, the source interface, and whether NTP authentication keys match on both ends.

Related reading on this site: chrony NTP time sync and drift troubleshooting (Linux) and SNMPv3 configuration on Cisco IOS and Junos.

原文链接：https://blog.ipspace.net/kb/Internet/NTP/30-configuration/