{"id":83,"date":"2026-08-06T18:49:23","date_gmt":"2026-08-06T18:49:23","guid":{"rendered":"https:\/\/mrnetwork.nl\/index.php\/secure-ntp-2\/"},"modified":"2026-08-06T20:00:03","modified_gmt":"2026-08-06T20:00:03","slug":"secure-ntp-2","status":"publish","type":"page","link":"https:\/\/mrnetwork.nl\/index.php\/secure-ntp-2\/","title":{"rendered":"Secure NTP"},"content":{"rendered":"

Terug naar home<\/a><\/p>\n

Secure NTP <\/h1>\n
The Network Time Protocol (NTP) is the de-facto means Internet hosts useto synchronize their clocks. A reliable and accurate notion of time isimportant for a number of services, including distributed applications,authentication services, multi-user databases and logging services to namejust a few. The NTP is one of those few systems that sees ubiquitousdeployment across systems of all types and sizes. It is therefore importantthat the NTP infrastructure is secure and trustworthy. Negligent NTPconfigurations can lead to a select set of potential problems, including NTPhosts becoming unwitting participants in reflector and amplification DDoSattacks. This template provides guidelines for proper and secure operationof the NTP service on a number of different platforms andconfigurations.<\/div>\n
\n

! ! W A R N I N G ! !<\/h4>\n<\/div>\n
As with all such templates, this one must be modified to fit the specificrequirements of the local network(s) and hosts. It is not wise to simply cutand paste without a thorough understanding of each command.<\/div>\n

<\/p>\n

General Considerations<\/div>\n
All implementations use UDP. The NTP server port is 123, but the sourceport is not easily determined without knowledge of the OS and NTPimplementation. We have even seen some implementations use port 123 forboth the source and destination port in NTP messages. While not shown, westrongly encourage the use of IETF BCP 38 to limit spoofed traffic, butparticularly to help mitigate spoofed NTP amplification and reflectionattacks. The configurations shown here assume that the host is primarilyacting as an NTP client and not an NTP server that delivers time to largepopulations of anonymous NTP clients. Those situations are less common andare better suited in another BCP document where additional detail would needto be covered in depth to adequately address time serving issues.<\/div>\n

<\/p>\n

Cisco IOS<\/div>\n
\n
For some recent versions of IOS the NTP access lists that restrict queries, i.e. query-only, will not take effect. In other words, control mode NTP packets cannot be filtered unless NTP authentication is applied or a fixed version of IOS is installed. See Cisco bug ID CSCuj66318 and additional discussion on the Cisco Forums:
https:\/\/supportforums.cisco.com\/discussion\/12061026\/ntp-acl-ios-xe-4500-x-bugged<\/a><\/div>\n<\/div>\n
This is a template IOS configuration that should work for most sites, butpay attention to the comments and notes. If your IOS devices synchronizewith a device that is capable of MD5 authentication, see further below forauthentication-specific statements. If you use control plane policing, besure you account for NTP traffic. You might also be interested in addingthe log<\/code> tag to some of your ACLs so you know who is trying totalk NTP to your boxes, but that is best left as a local decision so we havenot included it by default.<\/div>\n
\n
\n

TERMINAL<\/p>\n

    \n
  • ! Core NTP configuration <\/li>\n
  • ntp update-calendar ! update hardware clock (certain hardware only, i.e. 6509s) <\/li>\n
  • ntp server 192.0.2.1 ! a time server you sync with <\/li>\n
  • ntp peer 192.0.2.2 ! a time server you sync with and allow to sync to you <\/li>\n
  • ntp source Loopback0 ! we recommend using a loopback interface for sending NTP messages if possible<\/li>\n
  • ! <\/li>\n
  • ! NTP access control <\/li>\n
  • ntp access-group query-only 1 ! deny all NTP control queries <\/li>\n
  • ntp access-group serve 1 ! deny all NTP time and control queries by default <\/li>\n
  • ntp access-group peer 10 ! permit time sync to configured peer(s)\/server(s) only <\/li>\n
  • ntp access-group serve-only 20 ! permit NTP time sync requests from a select set of clients <\/li>\n
  • ! <\/li>\n
  • ! access control lists (ACLs) <\/li>\n
  • access-list 1 remark utility ACL to block everything <\/li>\n
  • access-list 1 deny any <\/li>\n
  • ! <\/li>\n
  • access-list 10 remark NTP peers\/servers we sync to\/with <\/li>\n
  • access-list 10 permit 192.0.2.1remark NTP peers\/servers we sync to\/with <\/li>\n
  • access-list 10 permit 192.0.2.2 <\/li>\n
  • access-list 10 deny any <\/li>\n
  • ! <\/li>\n
  • access-list 20 remark Hosts\/Networks we allow to get time from us <\/li>\n
  • access-list 20 permit 192.0.2.0 0.0.0.255 <\/li>\n
  • access-list 20 deny any <\/li>\n<\/ul>\n<\/div>\n<\/div>\n
    Simple NTP authentication using MD5 in IOS can easily be managed for alimited set of static peers and upstream time providers that support it.Since this is generally a manual process, MD5 authentication support for a alarge set of clients is likely to be unwieldy. Nonetheless, this featureprovides some additional protection from unwanted NTP messages. Thisexample assumes that you create an ‘ntp authentication-key’ for eachpeer\/server. The key can be re-used, but we do not recommend re-using thesame key with peers or upstreams from different autonomous systems. Alsocreate a ‘ntp trusted-key’ line for each keyid you’ve configured. Pleasenote, we have seen some gear limit the pass phrase to eight characters.<\/div>\n
    \n
    \n

    TERMINAL<\/p>\n

      \n
    • ntp authenticate ! enable NTP authentication <\/li>\n
    • ntp authentication-key [key-id] md5 [hash] ! define a NTP authentication key <\/li>\n
    • ntp trusted-key [key-id] ! mark a NTP authentication key as trusted <\/li>\n
    • ntp peer [peer_address] key [key-id] ! form a authenticated session with a peer <\/li>\n
    • ntp server [server_address] key [key-id] ! form a authenticated session with a server <\/li>\n<\/ul>\n<\/div>\n<\/div>\n
      The following commands may prove helpful to monitor or debug NTP issues on IOS.<\/div>\n
      \n
      \n

      TERMINAL<\/p>\n

        \n
      • ! general NTP and clock status <\/li>\n
      • show ntp status <\/li>\n
      • ! lists synchronization details with configured peer(s)\/server(s) <\/li>\n
      • show ntp associations [detail] <\/li>\n
      • ! shows or logs detailed NTP messages\/packets <\/li>\n
      • ! WARNING: not recommended for general use in a production network!! <\/li>\n
      • debug ntp […] <\/li>\n<\/ul>\n<\/div>\n<\/div>\n

        <\/p>\n

        Juniper JUNOS<\/div>\n
        The following configuration statements will define one or more timeservers the router will obtain time from. The boot-server option is used toget a significantly skewed clock back into sync. To protect the local ntpdprocess in JUNOS you can use firewall filters on the loopback interface asyou likely do for other services. Authentication can also be done on theJuniper ntpd process and it can be easily managed for a limited set ofstatic peers and upstream time providers that support it. Since this isgenerally a manual process, authentication support for a large set ofclients is likely to be unwieldy. Nonetheless, this feature provides someadditional protection from unwanted NTP messages. This example assumes thatyou create an ntp ‘authentication-key’ for each peer\/server. The key can bere-used, but we do not recommend re-using the same key with peers orupstreams from different autonomous systems. Where you see the [key-id]option, adjust that statement according to your authentication setup, ifany.<\/div>\n
        \n
        \n

        TERMINAL<\/p>\n

          \n
        • system { <\/li>\n
        • ntp { <\/li>\n
        • authentication-key [key-id] type md5 value “[pass-phrase]”; <\/li>\n
        • trusted-key [key-id]; <\/li>\n
        • \/* Allow NTP to sync if server clock is significantly different than local clock *\/ <\/li>\n
        • boot-server 192.0.2.1; <\/li>\n
        • \/* NTP server to sync to *\/ <\/li>\n
        • server 192.0.2.1; <\/li>\n
        • server 192.0.2.2 key [key-id] prefer; <\/li>\n
        • } <\/li>\n
        • } <\/li>\n<\/ul>\n<\/div>\n<\/div>\n
          You can use your loopback filter that shields the router from otheranonymous access to also limit who the local NTP service talks to. Therelevant section of that filter might look something like the following:<\/div>\n
          \n
          \n

          TERMINAL<\/p>\n

            \n
          • from { <\/li>\n
          • source-address { <\/li>\n
          • 0.0.0.0\/0; <\/li>\n
          • \/* NTP server to get time from *\/ <\/li>\n
          • 192.0.2.1\/32 except; <\/li>\n
          • } <\/li>\n
          • protocol udp; <\/li>\n
          • port ntp; <\/li>\n
          • } <\/li>\n
          • then { <\/li>\n
          • discard; <\/li>\n
          • } <\/li>\n<\/ul>\n<\/div>\n<\/div>\n
            You must then eventually have a default accept-all rule or, if you have a default deny, you must explicitly allow your router to talk to whatever NTP systems it uses for time synchronization. For example, to add a explicit rule to permit NTP traffic, your configuration might look something like this:<\/div>\n
            \n
            \n

            TERMINAL<\/p>\n

              \n
            • from { <\/li>\n
            • source-address { <\/li>\n
            • \/* NTP server to get time from *\/<\/li>\n
            • 192.0.2.1\/32; <\/li>\n
            • } <\/li>\n
            • protocol udp; <\/li>\n
            • port ntp; <\/li>\n
            • } <\/li>\n
            • then { <\/li>\n
            • accept; <\/li>\n
            • } <\/li>\n<\/ul>\n<\/div>\n<\/div>\n

              <\/p>\n

              UNIX ntpd<\/div>\n
              The following configuration is for a UNIX machine to act as simply an NTPclient and never to allow NTP queries to it except from the loopbackaddress:<\/div>\n
              \n
              \n

              TERMINAL<\/p>\n

                \n
              • # by default act only as a basic NTP client <\/li>\n
              • restrict -4 default nomodify nopeer noquery notrap <\/li>\n
              • restrict -6 default nomodify nopeer noquery notrap <\/li>\n
              • # allow NTP messages from the loopback address, useful for debugging <\/li>\n
              • restrict 127.0.0.1 <\/li>\n
              • restrict ::1 <\/li>\n
              • # server(s) we time sync to <\/li>\n
              • server 192.0.2.1 <\/li>\n
              • server 2001:DB8::1 <\/li>\n
              • server time.example.net <\/li>\n<\/ul>\n<\/div>\n<\/div>\n
                You can use your standard host firewall filtering capabilities to limitwho the NTP process talks to. If you’re using Linux and the host is actingas an NTP client only, the following iptables rules could be adapted to shieldyour NTP listener from unwanted remote hosts.<\/div>\n
                \n
                \n

                TERMINAL<\/p>\n

                  \n
                • -A INPUT -s 0\/0 -d 0\/0 -p udp –source-port 123:123 -m state –state ESTABLISHED -j ACCEPT<\/li>\n
                • -A OUTPUT -s 0\/0 -d 0\/0 -p udp –destination-port 123:123 -m state –state NEW,ESTABLISHED -j ACCEPT<\/li>\n<\/ul>\n<\/div>\n<\/div>\n
                  Authentication with the reference NTP software on UNIX can be done usingsymmetric key encryption, much like in Cisco IOS and Juniper JUNOS, usingMD5. However, a public key-based approach called ‘AutoKey’ is alsoavailable, which is generally be considered to be even more secure. Formore information about these options, see the NTP authentication options page<\/a> and the Configuring Autokey documentation<\/a>.<\/div>\n

                  <\/p>\n

                  A Note About Broadcast\/Multicast NTP<\/div>\n
                  In our experience multicast-enabled NTP clients are often setup with noauthentication or access control. Particularly on networks that areconnected to the multicast-enabled Internet, these hosts may be exposed tounreliable and untrustworthy NTP servers. We recommend against multicastNTP configurations unless it is absolutely necessary and even then westrongly suggest the use of access control and authentication to mitigatethe threat of untrustworthy sources. If you do not need multicast NTPsupport, but you do support IP multicast on your network, you shouldconsider filtering the well known multicast group address for NTP(224.0.1.1<\/code>) at your border.<\/div>\n

                  <\/p>\n

                  A Note About Border NTP Filtering<\/div>\n
                  Some networks may consider filtering all or some NTP traffic betweentheir network and others. This is potentially very troublesome and shouldonly be considered and implemented with a full understanding of theramifications. We cannot advocate this action by default, but can offersome guidelines to those who wish to do so.<\/div>\n
                  All packets to\/from TCP port 123 should be safe to filter since NTP bydesign only uses UDP. This might, however, affect anyone who attempts tosetup another application on TCP port 123 for some reason or any possiblefuture extension of NTP that might use TCP.<\/div>\n
                  Filtering packets from your networks to external networks with UDP sourceport 123 and\/or packets to your networks from external networks with UDPdestination port 123 will certainly prevent your hosts from communicating asNTP servers to outside entities, but it may also prevent some NTP hosts fromacting as NTP clients as well. We have seen some clients use port 123 forsource ports. Filtering in this scenario then may cause problems for thoseclients.<\/div>\n
                  If you can ensure your internal hosts will only act as clients and alllegitimate clients will use an unprivileged client port selection strategyyou could probably apply the above aforementioned filter. We would recommendlogging or monitoring the filters to assist with troubleshooting should itbe necessary. Also, use your systems’s built in NTP monitoring capabilitiesto ensure all your NTP client systems remain in sync.<\/div>\n
                  If you block all UDP 123 traffic so that no clients may talk to externalservers, you should ensure all your internal hosts are setup to use one ormore internal NTP servers. Since many system components rely on an accuratenotition of time and most use NTP to do so, it is important to provide thisservice. Note, except for the most limited and restrictive of networks, wedo not find it necessary to completely block NTP for all your hosts as longas those hosts can be secured in the kinds of ways suggested in the templateconfigs above.<\/div>\n","protected":false},"excerpt":{"rendered":"

                  Terug naar home Secure NTP The Network Time Protocol (NTP) is the de-facto means Internet hosts useto synchronize their clocks. A reliable and accurate notion of time isimportant for a number of services, including distributed applications,authentication services, multi-user databases and logging services to namejust a few. The NTP is one of those few systems that […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"blank","meta":{"footnotes":""},"class_list":["post-83","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/mrnetwork.nl\/index.php\/wp-json\/wp\/v2\/pages\/83","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mrnetwork.nl\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/mrnetwork.nl\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/mrnetwork.nl\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mrnetwork.nl\/index.php\/wp-json\/wp\/v2\/comments?post=83"}],"version-history":[{"count":5,"href":"https:\/\/mrnetwork.nl\/index.php\/wp-json\/wp\/v2\/pages\/83\/revisions"}],"predecessor-version":[{"id":187,"href":"https:\/\/mrnetwork.nl\/index.php\/wp-json\/wp\/v2\/pages\/83\/revisions\/187"}],"wp:attachment":[{"href":"https:\/\/mrnetwork.nl\/index.php\/wp-json\/wp\/v2\/media?parent=83"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}