配置带认证的NTP客户端/服务器模式
配置注意事项
- 客户端必须先开启NTP认证，然后再指定NTP服务器地址，并同时指定发给服务器的验证密钥。否则将不进行验证，直接同步。
- 客户端与服务器端必须配置相同的验证密钥，并声明该密钥可信，否则无法通过验证。
- 在服务器和客户端均启用NTP认证。
操作步骤
- 配置各设备的IP地址并确保路由可达。
- 在DeviceA配置NTP主时钟、侦听接口并启动验证功能。
# 在DeviceA上指定使用自己的本地时钟作为参考时钟，层数为2。
<DeviceA> system-view [~DeviceA] ntp refclock-master 2 [*DeviceA] commit
# 在DeviceA上指定侦听接口。
[~DeviceA] ntp server source-interface 100ge 1/0/1 [*DeviceA] commit
# 在DeviceA上开启NTP认证功能并配置验证密钥。
[~DeviceA] ntp authentication enable [*DeviceA] ntp authentication-keyid 42 authentication-mode hmac-sha256 ******** [*DeviceA] commit
注意服务器端与客户端必须配置相同的验证密钥。
# 在DeviceA上开启NTP服务器功能。
[~DeviceA] undo ntp server disable [*DeviceA] commit
- 在DeviceB启动验证功能、指定侦听接口和NTP服务器。
# 在DeviceB上开启NTP认证功能、配置验证密钥并声明该密钥可信。
<DeviceB> system-view [~DeviceB] ntp authentication enable [*DeviceB] ntp authentication-keyid 42 authentication-mode hmac-sha256 ******** [*DeviceB] ntp trusted authentication-keyid 42 [*DeviceB] commit
# 在DeviceB上指定侦听接口。
[~DeviceB] ntp server source-interface 100ge 1/0/1 [*DeviceB] commit
# DeviceB指定DeviceA为NTP服务器，并使用已配置的验证密钥。
[~DeviceB] ntp unicast-server 2.2.2.2 authentication-keyid 42 [*DeviceB] commit
# 在DeviceB上开启NTP服务器功能。
[~DeviceB] undo ntp server disable [*DeviceB] commit
- 在DeviceC启动验证功能并指定NTP服务器。
<DeviceC> system-view [~DeviceC] ntp authentication enable [*DeviceC] ntp authentication-keyid 42 authentication-mode hmac-sha256 ******** [*DeviceC] ntp trusted authentication-keyid 42 [*DeviceC] ntp unicast-server 10.0.0.1 authentication-keyid 42 [*DeviceC] commit
- 在DeviceD启动验证功能并指定NTP服务器。
<DeviceD> system-view [~DeviceD] ntp authentication enable [*DeviceD] ntp authentication-keyid 42 authentication-mode hmac-sha256 ******** [*DeviceD] ntp trusted authentication-keyid 42 [*DeviceD] ntp unicast-server 10.0.0.1 authentication-keyid 42 [*DeviceD] commit
检查配置结果
# 查看DeviceB的NTP状态，可以看到时钟状态为“synchronized”，即已经完成同步。时钟的层数为3，比服务器DeviceA低1级。
[~DeviceB] display ntp status clock status: synchronized clock stratum: 3 reference clock ID: 2.2.2.2 nominal frequency: 60.0002 Hz actual frequency: 60.0002 Hz clock precision: 2^18 clock offset: 3.8128 ms root delay: 31.26 ms root dispersion: 74.20 ms peer dispersion: 34.30 ms reference time: 11:55:56.833 UTC Feb 2 2020(C7B15BCC.D5604189) synchronization state: clock synchronized
# 查看DeviceC的NTP状态，可以看到时钟状态为“synchronized”，即，已经完成同步。时钟的层数为4，比服务器DeviceB低1级。
[~DeviceC] display ntp status clock status: synchronized clock stratum: 4 reference clock ID: 10.0.0.1 nominal frequency: 60.0002 Hz actual frequency: 60.0002 Hz clock precision: 2^18 clock offset: 3.8128 ms root delay: 31.26 ms root dispersion: 74.20 ms peer dispersion: 34.30 ms reference time: 11:55:56.833 UTC Feb 2 2020(C7B15BCC.D5604189) synchronization state: clock synchronized
# 查看DeviceD的NTP状态，可以看到时钟状态为“synchronized”，即已经完成同步。时钟的层数为4，比服务器DeviceB低1级。
[~DeviceD] display ntp status clock status: synchronized clock stratum: 4 reference clock ID: 10.0.0.1 nominal frequency: 60.0002 Hz actual frequency: 60.0002 Hz clock precision: 2^18 clock offset: 3.8128 ms root delay: 31.26 ms root dispersion: 74.20 ms peer dispersion: 34.30 ms reference time: 11:55:56.833 UTC Feb 2 2020(C7B15BCC.D5604189) synchronization state: clock synchronized
# 查看DeviceA的NTP状态。
[~DeviceA] display ntp status clock status: synchronized clock stratum: 2 reference clock ID: LOCAL(0) nominal frequency: 60.0002 Hz actual frequency: 60.0002 Hz clock precision: 2^18 clock offset: 0.0000 ms root delay: 0.00 ms root dispersion: 26.50 ms peer dispersion: 10.00 ms reference time: 12:01:48.377 UTC Feb 2 2020(C7B15D2C.60A15981) synchronization state: clock synchronized
配置脚本
-
# sysname DeviceA # ntp authentication-keyid 42 authentication-mode hmac-sha256 cipher %+%#JA!v6M22=Gg\{>U.lx%#)c%yY}0*"/`5mi><QS)L%+%# ntp refclock-master 2 ntp authentication enable ntp server source-interface 100GE1/0/1 # interface 100GE1/0/1 undo portswitch ip address 2.2.2.2 255.255.255.0 # return -
# sysname DeviceB # ntp authentication-keyid 42 authentication-mode hmac-sha256 cipher %+%#>hD8))_H-XZVut2u3!_0lq3,+Ph=:OE}pX;T2M'9%+%# ntp trusted authentication-keyid 42 ntp unicast-server 2.2.2.2 authentication-keyid 42 ntp authentication enable ntp server source-interface 100GE1/0/1 # interface 100GE1/0/1 undo portswitch ip address 10.0.0.1 255.255.255.0 # interface 100GE1/0/2 undo portswitch ip address 10.1.1.11 255.255.255.0 # return -
# sysname DeviceC # ntp authentication-keyid 42 authentication-mode hmac-sha256 cipher %+%#m:fVJfk*r&3x"1J`21^K`Y;LH;B+g(t2<ZX^}Q_~%+%# ntp trusted authentication-keyid 42 ntp unicast-server 10.0.0.1 authentication-keyid 42 ntp authentication enable # interface 100GE1/0/1 undo portswitch ip address 10.0.0.2 255.255.255.0 # return
-
# sysname DeviceD # ntp authentication-keyid 42 authentication-mode hmac-sha256 cipher %+%#$\`_6BKWy1]kdR@=c;O@UX!)Vor5iYi|zIYEG_v5%+%# ntp trusted authentication-keyid 42 ntp unicast-server 10.0.0.1 authentication-keyid 42 ntp authentication enable # interface 100GE1/0/1 undo portswitch ip address 10.0.0.3 255.255.255.0 # return