Skip to content
Log in Sign up My account

3.3.a NTP and PTP

Blueprint 3.3.a: Interpret network time protocol configurations such as NTP and PTP

  • NTP roles: client, server, peer, master (authoritative source), broadcast
  • NTP stratum, associations and synchronization state
  • NTP authentication and access control
  • PTP (IEEE 1588) clock types, the Best Master Clock Algorithm and Catalyst PTP modes

The verb is interpret. You will be shown an NTP or PTP configuration, or show ntp associations and show ntp status output, and asked what the device is doing: which server it trusts, what stratum it will be, why it is not synchronized, or which PTP clock becomes grandmaster. You do not need to design a timing network from scratch.

Why time matters

Every log message, every debug, every NetFlow record and every certificate check depends on the clock. Two routers that disagree by four minutes turn a five-minute outage into a confusing pair of log files. Certificate-based features (IKEv2 with certificates, HTTPS, RESTCONF with a trusted CA, SD-WAN control connections) can fail outright if the clock is wrong, because the certificate looks expired or not yet valid. That is why the exam treats time as an infrastructure service next to NAT and FHRP.

NTP fundamentals

Network Time Protocol (NTPv4, RFC 5905) runs over UDP port 123 for both source and destination. A client polls one or more servers, measures round-trip delay and offset for each, filters out bad sources and slowly disciplines its own clock toward the best one. Cisco IOS XE supports NTPv4 and falls back to older versions with older peers.

Stratum

Stratum is the distance from a reference clock, not a measure of accuracy.

Stratum Meaning
0 Reference clock itself (GPS receiver, atomic clock). Not reachable over the network.
1 Server directly attached to a stratum 0 source
2 to 15 Each hop adds one: a client of a stratum n server becomes stratum n+1
16 Unsynchronized. A device at stratum 16 cannot be used as a source.

A device always advertises its own stratum as its source's stratum plus one. When a router shows stratum 4, its reference is at stratum 3.

graph TB
  GPS["GPS reference<br/>stratum 0"] --> S1["Time server<br/>stratum 1"]
  S1 -->|"UDP 123"| CORE1["CORE1<br/>stratum 2"]
  S1 -->|"UDP 123"| CORE2["CORE2<br/>stratum 2"]
  CORE1 <-->|"ntp peer"| CORE2
  CORE1 --> DIST["DIST1<br/>stratum 3"]
  CORE2 --> DIST
  DIST --> ACC["ACC1<br/>stratum 4"]

NTP association modes

Mode IOS XE command What it does
Client/server ntp server 10.0.0.1 This device polls the server and can be synchronized by it. The server is never synchronized by the client.
Symmetric active (peer) ntp peer 10.0.0.2 Two devices can synchronize each other. Whichever has the better (lower stratum) source wins. Used between core devices so they stay together if the upstream server fails.
Authoritative source ntp master [stratum] The device uses its own internal clock as a reference and serves time. Default stratum is 8.
Broadcast ntp broadcast on the server interface, ntp broadcast client on the client interface Server sends time to the LAN broadcast address; clients listen. Less accurate, rarely used.

Any synchronized device serves time to clients automatically. You do not need ntp master to make a router a server for downstream devices; you only need it when the router has no upstream source and must be the authority itself. ntp master is a common lab shortcut and a common exam distractor.

Exam trap

ntp master with no number makes the router stratum 8, not stratum 1. If a question shows ntp master on R1 and asks what stratum R1's client will show, the answer is 9. With ntp master 3 the client shows stratum 4.

Supporting commands

ntp server 10.0.0.1 prefer          ! prefer this server over others of similar quality
ntp server 10.0.0.2
ntp source Loopback0                ! source NTP packets from the loopback
ntp update-calendar                 ! keep the hardware calendar in sync (platforms with one)
clock timezone EST -5 0
clock summer-time EDT recurring
service timestamps log datetime msec localtime show-timezone

ntp source matters when the server or an ACL on the path only permits the loopback range. The timezone and summer-time commands change only the display: NTP itself always carries UTC.

Interpreting NTP show output

show ntp associations

R3# show ntp associations

  address         ref clock       st   when   poll reach  delay  offset   disp
*~10.255.255.1    192.0.2.10       2     22     64   377  1.204  -0.311  0.954
+~10.255.255.2    192.0.2.10       2     41     64   377  1.618   0.402  1.102
 ~10.255.255.9    .INIT.          16      -   1024     0  0.000   0.000 15937.
 * sys.peer, # selected, + candidate, - outlyer, x falseticker, ~ configured

How to read it, line by line:

  • address is the configured server or peer. ref clock is that server's source. .INIT. means the association has not completed yet.
  • st is the stratum of the server, so R3 itself will be stratum 3 (2 plus 1).
  • * marks the system peer, the source R3 is synchronized to. + is an acceptable candidate that is used in the combine algorithm. - is an outlier and x is a falseticker that disagrees with the others and is rejected. ~ means the association was configured statically (as opposed to learned).
  • poll is the polling interval in seconds. It starts at 64 and backs off toward 1024 when the clock is stable.
  • reach is an 8-bit shift register shown in octal. Each successful poll shifts in a 1. 377 means the last eight polls all succeeded. 0 means nothing has ever been heard. Values like 376 or 177 mean recent losses.
  • delay, offset and disp (dispersion) are in milliseconds. Large dispersion, as on the third line, is a sign of a source that cannot be used.

The third server is stratum 16 with reach 0. Typical causes: the server is unreachable, UDP 123 is filtered, an NTP access group blocks it, or authentication fails.

show ntp status

R3# show ntp status
Clock is synchronized, stratum 3, reference is 10.255.255.1
nominal freq is 250.0000 Hz, actual freq is 249.9998 Hz, precision is 2**10
ntp uptime is 154300 (1/100 of seconds), resolution is 4000
reference time is E8A1C3F2.1A2B3C4D (14:02:10.102 UTC Tue Nov 17 2026)
clock offset is -0.3110 msec, root delay is 2.41 msec
root dispersion is 3.92 msec, peer dispersion is 0.95 msec

The first line answers most exam questions: synchronized or not, the local stratum and the reference. An unsynchronized device shows Clock is unsynchronized, stratum 16, no reference clock.

Exam trap

The stratum in show ntp status is the local stratum. The st column in show ntp associations is the server's stratum. Questions often mix the two. Local stratum is always the system peer's st value plus one.

NTP authentication

NTP authentication lets a client verify its server. It does not encrypt time; it adds a keyed digest so a rogue server cannot move the clock. Three pieces must all be present on the client:

ntp authentication-key 1 md5 N7pK3y        ! define the key number and string
ntp trusted-key 1                          ! mark the key as trusted
ntp authenticate                           ! turn on authentication checking
ntp server 10.255.255.1 key 1              ! tell the client which key to use with this server

The server needs the same key number and string defined. Order of checks on the client: if ntp authenticate is on, the client will only synchronize to a server whose packets are signed with a key that is both defined and listed in ntp trusted-key.

Missing piece Result
ntp authenticate Authentication is not enforced. The client synchronizes to any reachable server, signed or not.
ntp trusted-key 1 Key exists but is not trusted. The server is never selected; it stays unsynchronized.
key 1 on the ntp server line Client does not sign its requests with the key, so the server replies are not authenticated and are rejected.
Key string mismatch Digest check fails. No synchronization.

Exam trap

A config that defines ntp authentication-key and ntp trusted-key but has no ntp authenticate will still synchronize, but to any server. The question "is this router protected against a rogue NTP server?" then has the answer no.

NTP access control

ntp access-group filters who may use this device for time, with a standard ACL per access type. The types, from most to least permissive:

Keyword Allows
peer Time requests, control queries, and synchronizing this device to the matched host
serve Time requests and control queries, but this device will not synchronize to the matched host
serve-only Time requests only
query-only Control queries only (no time) 
access-list 10 permit 10.255.255.1
access-list 20 permit 10.0.0.0 0.255.255.255
ntp access-group peer 10
ntp access-group serve-only 20

Here R1 synchronizes only to 10.255.255.1 and serves time to anything in 10.0.0.0/8. A classic fault is configuring only serve-only and forgetting peer for the upstream server, which stops the router synchronizing at all because its own server is no longer permitted to sync it.

PTP (Precision Time Protocol, IEEE 1588)

NTP is good to a few milliseconds over a LAN and tens of milliseconds over a WAN. Some applications need far better: industrial automation, power utility substations, broadcast audio and video, mobile backhaul and financial trading. PTP (IEEE 1588, version 2 is the 2008 edition) reaches sub-microsecond accuracy by using hardware timestamping on the port as the packet leaves and arrives, and by letting switches correct for their own queuing delay.

Clock types

Clock Role
Grandmaster (GM) The best clock in the PTP domain, usually GPS-locked. Root of the timing tree.
Ordinary clock (OC) One PTP port. Either a GM or an end device (slave) that only receives time.
Boundary clock (BC) Several PTP ports. Synchronizes to the upstream master on one port, then acts as master on the others. Terminates and regenerates PTP, which splits the network into smaller timing segments.
Transparent clock (TC) Does not synchronize itself. Forwards PTP messages and adds the time each message spent inside the switch (residence time) into a correction field. End-to-end TC corrects residence time only. Peer-to-peer TC also measures the delay of each link to its neighbor.

Cisco documents and newer releases often use primary and secondary (or leader and follower) in place of master and slave. The exam may use either.

graph TB
  GM["Grandmaster<br/>GPS locked"] -->|"Sync, Follow_Up, Announce"| BC["Distribution switch<br/>boundary clock"]
  BC -->|"master port"| TC["Access switch<br/>transparent clock"]
  BC -->|"master port"| OC2["IED or camera<br/>ordinary clock"]
  TC -->|"adds residence time"| OC1["PLC<br/>ordinary clock"]

How PTP measures offset

The master sends Sync at time t1 and the slave receives it at t2. In two-step mode the precise t1 is carried in a Follow_Up message; in one-step mode it is written into the Sync itself. The slave sends Delay_Req at t3 and the master records arrival t4, returning it in Delay_Resp.

sequenceDiagram
  participant M as Master
  participant S as Slave
  M->>S: Sync (sent t1, received t2)
  M->>S: Follow_Up (carries exact t1)
  S->>M: Delay_Req (sent t3, received t4)
  M->>S: Delay_Resp (carries t4)
  Note over S: path delay = ((t2-t1)+(t4-t3))/2
  Note over S: offset = ((t2-t1)-(t4-t3))/2

The calculation assumes the path is symmetric. Any asymmetry, such as a queue on one direction only, shows up directly as offset error. That is the reason transparent and boundary clocks exist: they remove queuing delay from the equation.

Announce messages carry each clock's quality. Over IPv4, PTP uses UDP 319 for event messages (Sync, Delay_Req, which are timestamped) and UDP 320 for general messages (Announce, Follow_Up, Delay_Resp). It can also run directly over Ethernet (EtherType 0x88F7).

Best Master Clock Algorithm (BMCA)

There is no stratum in PTP. Every clock compares the Announce messages it receives and the best one becomes grandmaster. Comparison order, lower wins at every step:

  1. Priority1 (0 to 255, default 128). The administrator's override.
  2. Clock class (for example, GPS-locked versus free-running).
  3. Clock accuracy.
  4. Offset scaled log variance (stability).
  5. Priority2 (0 to 255, default 128). Tiebreaker between otherwise equal clocks, often used to pick a backup GM.
  6. Clock identity (derived from the MAC address).

Exam trap

In BMCA a lower priority1 wins. Setting ptp priority1 255 on a switch makes it the least likely grandmaster, not the most likely. Also, priority1 is checked before clock quality, so a lower priority1 beats a better clock.

PTP domains and profiles

A domain number (default 0) separates independent PTP systems on the same network. Clocks only interact within the same domain. A profile is a set of defaults for a use case: the default 1588 profile (delay request-response), the power profile (IEEE C37.238, Layer 2, peer delay) for substations, and IEEE 802.1AS (gPTP) for audio and video bridging.

PTP on Catalyst 9000 (IOS XE)

PTP is a switch feature with hardware timestamping. Exact keywords vary by platform and release, so read the config guide for your switch; the exam concentrates on recognizing the modes.

ptp mode boundary delay-req
ptp priority1 100
ptp priority2 100
ptp domain 0

ptp mode e2etransparent

ptp mode p2ptransparent

ptp mode gptp

Verification:

SW1# show ptp clock
SW1# show ptp parent        ! who is my parent and who is the grandmaster
SW1# show ptp port          ! state of each port: master, slave, passive, listening

show ptp parent is the PTP equivalent of finding the * line in show ntp associations: it names the grandmaster identity and the parent port's clock.

NTP versus PTP

NTP PTP (IEEE 1588v2)
Typical accuracy Milliseconds Sub-microsecond with hardware timestamping
Transport UDP 123 UDP 319/320, or Ethernet 0x88F7
Source selection Stratum, delay, dispersion, client selection algorithm BMCA on Announce messages (priority1 first)
Hierarchy term Stratum 1 to 15 Grandmaster, boundary, transparent, ordinary
Network help None, pure software Boundary and transparent clocks in switches
Typical use Logs, certificates, AAA, general IT Industrial, utilities, broadcast, mobile backhaul

Lab: NTP hierarchy with authentication

Topology: the course base topology. R1 is the authoritative source. DIST1 and DIST2 synchronize to R1 with authentication and peer with each other. ACC1 uses both distribution switches.

graph TB
  R1["R1 Lo0 10.255.255.1<br/>ntp master 3"] -->|"key 1"| D1["DIST1 Lo0 10.255.255.11"]
  R1 -->|"key 1"| D2["DIST2 Lo0 10.255.255.12"]
  D1 <-->|"ntp peer"| D2
  D1 --> A1["ACC1"]
  D2 --> A1

  1. On R1, make it the authority and define the key.

    clock set 14:00:00 17 Nov 2026          ! exec mode, so the master starts near real time
conf t
ntp authentication-key 1 md5 LabKey1
ntp trusted-key 1
ntp authenticate
ntp master 3
ntp source Loopback0

  2. On DIST1 (repeat on DIST2 with the peer address swapped):

    ntp authentication-key 1 md5 LabKey1
ntp trusted-key 1
ntp authenticate
ntp server 10.255.255.1 key 1
ntp peer 10.255.255.12 key 1
ntp source Loopback0

  3. On ACC1: ntp server 10.255.255.11 and ntp server 10.255.255.12, no authentication.

  4. Wait a few minutes (NTP is deliberately slow to converge), then verify on DIST1:

    DIST1# show ntp associations
  address         ref clock       st   when   poll reach  delay  offset   disp
*~10.255.255.1    127.127.1.1      3     12     64    17  1.010   0.120  1.950
 ~10.255.255.12   10.255.255.1     4     30     64    17  1.300   0.240  2.010

DIST1# show ntp status
Clock is synchronized, stratum 4, reference is 10.255.255.1

    The ref clock 127.127.1.1 is how IOS shows a master that is using its own internal clock. ACC1 should end up at stratum 5.

  5. Break it. On DIST2 remove ntp trusted-key 1. Watch show ntp associations on DIST2: reach drops to 0 or the server never gets *, and show ntp status eventually reports unsynchronized. Put it back.

  6. Break it differently. On R1 add access-list 30 permit 10.255.255.11 and ntp access-group serve-only 30. DIST2 loses R1 as a source but stays synchronized through its peer DIST1. Explain why from the output, then remove the access group.

Quick check

R2 has ntp server 10.1.1.1 and show ntp associations shows that server with st 5, reach 377 and a *. What does show ntp status on R2 report as its stratum?

Stratum 6. The st column is the server's stratum, and a client is always one higher than its system peer.

A router has ntp authentication-key 5 md5 X, ntp trusted-key 5 and ntp server 10.0.0.1 key 5, but not ntp authenticate. A rogue server at 10.0.0.1 sends unsigned time. Will the router accept it?

Yes. Without ntp authenticate, signatures are not enforced and the router synchronizes to the server whether or not its packets are authenticated.

Two PTP grandmaster candidates both have clock class 6. Switch A has priority1 128, switch B has priority1 110. Which becomes grandmaster, and what would make A win instead?

Switch B, because a lower priority1 wins and priority1 is compared first. A would win if its priority1 were set below 110, regardless of the clock quality fields that follow.

References

  • RFC 5905, Network Time Protocol Version 4: rfc-editor.org/rfc/rfc5905
  • IEEE 1588-2008, Precision Clock Synchronization Protocol (IEEE standard, not freely published)
  • Cisco IOS XE Basic System Management Configuration Guide, "Configuring NTP" (search on cisco.com)
  • Catalyst 9300 / 9400 / 9500 Layer 2 or Precision Time Protocol configuration guide for your IOS XE release (search "Configuring Precision Time Protocol" on cisco.com)
  • Cisco Live On-Demand Library: search "Precision Time Protocol" and "NTP best practices"