NTP in a PoP Example
Devices in an ISP PoP do not need to be part of the backbone NTP mesh. Instead, the devices in the PoP (routers, NAS, switches, and workstations) use the two core PoP gateway routers as the NTP servers for the PoP. All devices will use both routers as NTP sources, simplifying the NTP configuration and decreasing the NTP convergence time in the PoP.
As can be seen in Figure 1-4, devices in a PoP all need time synchronization. Accounting on the RADIUS server needs to be synchronized with the NAS equipment, which needs to be synchronized with the syslog server, which needs to be synchronized with the access routers, which needs to be synchronized with the NetFlow collectors, and so on. Having all devices use the same two servers (one primary, one backup) ensures time synchronization among all devices.
Figure 1-4. Typical Internet PoP Built for Redundancy and Reliability Using the Core Routers as NTP Servers
Figure 1-4. Typical Internet PoP Built for Redundancy and Reliability Using the Core Routers as NTP Servers
Configuration is simplified with only two servers. For example, NAS 1, a Cisco 3640 with 96 built-in modems, would have a configuration highlighted in Example 1-2. PoP gateway routers Core 1 and Core 2 have two configuration options. First, each device in the PoP can be manually configured with an ntp peer command. Even though the peer commands open the gateway routers to have the capability to allow synchronization, the ntp server commands on the PoP devices will make this unlikely. Yet, there is always the chance of maintenance-induced trouble (MIT)— misconfiguration on the PoP gateway or on one of the PoP network devices.
Therefore, a second option offers more protection. This second option uses the ntp access-group command to limit what can query, serve, and be an NTP peer. Examples 1-1 and 1-2 demonstrate how the ntp access-group command is used to add an extra layer of security for all the NTP peers on the ISP's backbone while allowing a general access list to cover all the devices in the PoP. If the ISP is following a logical addressing plan, the whole PoP will be assigned one block of IP addresses for all the infrastructure and loopback addresses. This makes the ntp access-group serve-only ACL easier to create, with one ACL covering the entire PoP.
Example 1-1 NTP Configuration for the PoP Gateway Routers
! PoP Gateway Router !
ntp authentication-key 4235 md5 ISPWorkshop ntp authenticate ntp trusted-key 4235
! Lock NTP source to the uplink ntp source LoopbackO ntp update-calendar
! List of NTP Peers - Adding an additional Security Layer ntp access-group peer 99 !
! Allow PoP Devices to use this router as an NTP Server ntp access-group serve-only 42 !
! Loopback Addresses of the Backbone Routers ntp peer 200.200.1.1 ntp peer 200.200.1.2 ntp peer 200.200.1.3
Example 1-2 NTP Devices in the PoP
ntp authentication-key 4235 md5 ISPWorkshop ntp authenticate !
! Lock NTP source to the uplink ntp source Loopback0
ntp update-calendar !
! IP Addresses to Routers Core 1 and Core 2 ntp server 192.135.248.249 ntp server 192.135.248.250
Continue reading here: SNMP in Read Only Mode
Was this article helpful?