Configuring NTP Access Restrictions

Last Updated on Tue, 20 Dec 2022 | Global Configuration

You can control NTP access on two levels as described in these sections:

♦ Creating an Access Group and Assigning a Basic IP Access List, page 7-40

♦ Disabling NTP Services on a Specific Interface, page 7-41

Creating an Access Group and Assigning a Basic IP Access List

Beginning in privileged EXEC mode, follow these steps to control access to NTP services by using access lists:

Step 1 Step 2

Step 3

Step 4 Step 5 Step 6

Command

Purpose

configure terminal

Enter global configuration mode.

ntp access-group {query-only | serve-only | serve | peer}

access-list-number

Create an access group, and apply a basic IP access list. The keywords have these meanings:

♦ query-only—Allows only NTP control queries.

♦ serve-only—Allows only time requests.

♦ serve—Allows time requests and NTP control queries, but does not allow the switch to synchronize to the remote device.

♦ peer—Allows time requests and NTP control queries and allows the switch to synchronize to the remote device.

For access-list-number, enter a standard IP access list number from 1 to 99.

access-list access-list-number permit source [source-wildcard]

Create the access list.

♦ For access-list-number, enter the number specified in Step 2.

♦ Enter the permit keyword to permit access if the conditions are matched.

♦ For source, enter the IP address of the device that is permitted access to the switch.

♦ (Optional) For source-wildcard, enter the wildcard bits to be applied to the source.

Note When creating an access list, remember that, by default, the end of the access list contains an implicit deny statement for everything if it did not find a match before reaching the end.

end

Return to privileged EXEC mode.

show running-config

Verify your entries.

copy running-config startup-config

(Optional) Save your entries in the configuration file.

Step 1 Step 2

Step 3

Step 4 Step 5 Step 6

The access group keywords are scanned in this order, from least restrictive to most restrictive:

1. peer—Allows time requests and NTP control queries and allows the switch to synchronize itself to a device whose address passes the access list criteria.

2. serve—Allows time requests and NTP control queries, but does not allow the switch to synchronize itself to a device whose address passes the access list criteria.

3. serve-only—Allows only time requests from a device whose address passes the access list criteria.

4. query-only—Allows only NTP control queries from a device whose address passes the access list criteria.

If the source IP address matches the access lists for more than one access type, the first type is granted. If no access groups are specified, all access types are granted to all devices. If any access groups are specified, only the specified access types are granted.

To remove access control to the switch NTP services, use the no ntp access-group {query-only | serve-only | serve | peer} global configuration command.

This example shows how to configure the switch to allow itself to synchronize to a peer from access list 99. However, the switch restricts access to allow only time requests from access list 42:

Switch# configure terminal Switch(config)# ntp access-group peer 99 Switch(config)# ntp access-group serve-only 42 Switch(config)# access-list 99 permit 172.20.130.5 Switch(config)# access list 42 permit 172.20.130.6

Disabling NTP Services on a Specific Interface

NTP services are enabled on all interfaces by default.

Beginning in privileged EXEC mode, follow these steps to disable NTP packets from being received on an interface:

Step 1 Step 2 Step 3

Step 4 Step 5 Step 6

Command

Purpose

configure terminal

Enter global configuration mode.

interface interface-id

Enter interface configuration mode, and specify the interface to disable.

ntp disable

Disable NTP packets from being received on the interface. By default, all interfaces receive NTP packets.

end

Return to privileged EXEC mode.

show running-config

Verify your entries.

copy running-config startup-config

(Optional) Save your entries in the configuration file.

To re-enable receipt of NTP packets on an interface, use the no ntp disable interface configuration command.

Continue reading here: Configuring the Source IP Address for NTP Packets

Was this article helpful?

+2 -3

Related Posts

Readers' Questions

  • Anita
    What switch would allow you to restrict requests to ipv4?
    3 months ago
    • The -4 switch.
    • temesgen
      How to restrict ntp mode 6 queries in cisco?
      1 year ago
      • To restrict NTP mode 6 queries in Cisco routers, use the ntp access-group command. This command will restrict which hosts can make mode 6 queries based on their IP address or access list. For example, the following command will only allow mode 6 queries from hosts with IP addresses 10.0.0.0/24: ntp access-group peer 10.0.0.0 255.255.255.0.
      • ruta
        How to configure ntp access restriction on cisco devices?
        1 year ago
        1. To configure NTP access restriction on a Cisco device, use the following commands:a) Configure an access list to match the IP addresses of the systems that will receive or send NTP traffic: access-list <access-list-number> permit <IP-address> b) Apply the access list to an NTP access group: ntp access-group <access-list-number> c) Configure the access group type: ntp access-group <access-list-number> <mode> where mode is either ‘serve’ or ‘query’. d) Enable the access group: ntp access-group <access-list-number> enable. e) Save the NTP configuration: copy running-config startup-config
        • KERR BOYLE
          How to create an accessgroup for ntp mode 6?
          1 year ago
          1. Log into the server that houses the NTP daemon.
          2. Create a group that will access the NTP daemon.
          3. Edit /etc/ntp.conf and add the following lines:accessgroup mygroup nomodify notrap restrict default limited kod nomodify notrap nopeer noquery restrict 127.0.0.1 restrict 10.0.0.0 mask 255.0.0.0 nomodify notrap restrict 172.16.0.0 mask 255.240.0.0 nomodify notrap restrict 192.168.0.0 mask 255.255.0.0 nomodify notrap
          4. Add the IP addresses of the hosts that will be allowed to access to the mygroup group at the bottom of the list.
          5. Bind to the NTP port, if it has not already been done using the following command:ntpq –pn
          6. Restart the NTP daemon using the following command:/etc/init.d/ntp restart
          7. All hosts in the mygroup group can now access NTP in mode 6.
          • asphodel
            How do I query ntp on a remote node?
            1 year ago
            • You can query ntp on a remote node using the ntpq command. To query ntp on a remote node, you will need to specify the address of the remote node you want to query. For example: ntpq -p <remote_node_address>
            • vanessa
              How to restrict ntp mode 6 queries in hp Switch command?
              1 year ago
              • ntp access-group noquery To restrict NTP mode 6 queries in an HP switch, use the following command: ntp access-group noquery
              • Tiziano
                Does ntp accessgroup peer restrict mode 6 queries?
                1 year ago
              • Connie
                What is ntp allow mode control 3?
                1 year ago
                • NTP allow mode control 3 is a setting in the NTP software which allows the administrator to control which packets are allowed access to the NTP server. It provides an extra layer of control over the behavior of the NTP server by allowing only certain types of packets (such as NTP control packets) to be accepted by the server. This feature can be useful if the administrator wants to block certain types of traffic from reaching the NTP server.
                • hiewan
                  How to restrict ntp to a specific interface?
                  1 year ago
                  • To restrict NTP to a specific interface, edit the ntp.conf configuration file and specify the interface to use. For example: interface listen <interface_name>