Admin Guide

After the NTP client queries the remote time servers, the servers respond with various timestamps,
along with information about their clocks, such as stratum, precision, and time reference, see Figure
3: NTP time servers operating in unicast client mode on page 130. The NTP client reviews the list
of responses from all available servers and chooses one as the best available time source from
which to synchronize its internal clock.
The following figure shows how NTP time servers operate in unicast mode.
Figure 3: NTP time servers operating in unicast client mode
NTP authentication
You can authenticate time synchronization to ensure that the local time server obtains its time
services only from known sources. NTP authentication adds a level of security to your NTP
configuration. By default, network time synchronization is not authenticated.
If you select authentication, the switch uses the Message Digest 5 (MD5) algorithm to produce a
message digest of the key. The message digest is created using the key and the message, but the
key itself is not sent. The MD5 algorithm verifies the integrity of the communication, authenticates
the origin, and checks for timeliness.
To authenticate the message, the client authentication key must match that of the time server.
Therefore, you must securely distribute the authentication key in advance (the client administrator
must obtain the key from the server administrator and configure it on the client).
While a server can know many keys (identified by many key IDs) it is possible to declare only a
subset of these as trusted. The time server uses this feature to share keys with a client that requires
authenticated time and that trusts the server, but that is not trusted by the time server.
Network Time Protocol
October 2015 Administering Avaya VSP 7200 Series and 8000 Series 130
Comments on this document? [e-mail]