Jeff Kell wrote:
While we're on the subject, I came in this morning to find our core 6500
out of NTP sync. Checking the associations, a local host was in the
list as a "dynamic" association, with an invalid time.
Yeah, we've seen that. You need an ACL. This is dumb. To anyone from
cisco reading - this is dumb, fix it.
I was under the (apparently incorrect) assumption that IOS would not
accept unsolicited/unconfigured NTP control requests from anyone... as I
haven't revisited my NTP configuration in years.
The IOS in question (12.2(33)SXI2) does not have a "ntp broadcast
client" option I can simply turn off, as the generic NTP configuration
suggests.
The access-group documentation is a bit confusing...
I'd like to have control requests restricted to my configured 'ntp
server' list, but allow queries from anyone, and certainly not accept
NTP updates from unsolicited sources.
Does anyone have a nice, canned NTP config to accomplish this goal they
would care to share?
Ours does not do what you need; it restricts NTP querying to the NTP
servers & our management network (nagios checks the routers are in-sync
with an NTP query packet).
Give the caveat mentioned earlier in the thread (CSCsw79186) it's not
clear to me that you *can* do what you want.
Any reason you can't just run an NTP server?
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
