PlantUML DiagramNTP Hierarchy
A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
A security incident happened last Tuesday. Logs from three routers show different timestamps for the same events — off by 20 minutes. The forensic team can't correlate. The root cause: NTP was never configured on those routers, and their hardware clocks drifted at different rates. Without consistent time, log correlation becomes guesswork, certificates fail, and authentication protocols misbehave.
Time accuracy isn't a nicety — it's operational infrastructure. Kerberos fails if clocks drift more than 5 minutes. TLS certificates have validity windows that check against system time. Distributed tracing needs synchronized clocks to correlate events. Every network device should sync to authoritative time.
Stratum 0 is the reference clock itself (atomic, GPS). Stratum 1 servers are directly connected to stratum 0. Stratum 2 syncs from stratum 1, and so on. A device is at stratum N+1 where N is the best source it can reach. Stratum 16 means unsynchronized — the worst possible state.
! Configure an NTP server (public pool or internal)R1(config)# ntp server 216.239.35.0R1(config)# ntp server 216.239.35.4R1(config)# ntp server 162.159.200.1! Or use hostnames (requires DNS to be configured)R1(config)# ntp server 0.pool.ntp.org! Set a specific source interface (best practice on routers with multiple interfaces)R1(config)# ntp source loopback0! Optional — authenticate NTP for securityR1(config)# ntp authentication-key 1 md5 MyNTPKeyR1(config)# ntp authenticateR1(config)# ntp trusted-key 1! Make this router an NTP server for downstream devicesR1(config)# ntp master 3! VerifyR1# show ntp statusR1# show ntp associations
NTP is UDP port 123. If the network is behind a firewall, this port must be open in both directions (the request is UDP 123, the reply is UDP 123). NAT typically handles NTP fine but can occasionally cause issues if the return port is rewritten — some firewalls have an NTP ALG to handle this.
The key line: `Clock is synchronized, stratum 4`. If this says `Clock is unsynchronized, stratum 16` — no NTP source has been reached. The `reference is` line shows which NTP server is being used. `clock offset` under 10 milliseconds is good; under 1 ms is excellent for a corporate network.
NTP is boring until it's not. A device with a wrong clock causes intermittent, hard-to-diagnose issues — certificate errors, authentication failures, log correlation problems. Configure NTP on every device from the start. If you inherit a network with bad time, fixing it is one of the highest-value low-effort tasks you can do.
Finish the lesson once you have worked through the material. This awards ★ 35 XP.