Network Time Protocol
While troubleshooting, network operators often run through the logs to understand the symptoms of the problem and the timeline of the problem so they can find the relevant trigger of the problem. If the time is not synced on the devices, correlating the event across multiple devices becomes difficult. To overcome this problem, it is recommended to have the clock on the Nexus device synced with NTP throughout the network. NTP is used to synchronize clocks of devices in the network and on the Internet. NTP uses predefined UDP port number 123.
To configure NTP on the devices, enable NTP by using the command feature ntp. The Nexus device is configured for NTP depending on its role in the network (as either an NTP client or an NTP server). An NTP server receives its time from a time source that is attached to a time server and distributes the time across the network. As with distance-vector protocols, NTP uses a stratum value to describe the distance between a network device and an authoritative time source.
An NX-OS device can be configured as an NTP server and also an NTP peer. An NTP peer relationship enables network engineers to designate another host to consider synchronizing the time with in case a failure event occurs on the NTP server. The NTP server or NTP peer is defined using the command ntp [server | peer] [ip-address | ipv6-address] [prefer] [use-vrf vrf-name]. The configured NTP servers and peers are viewed using the command show ntp peers.
Additionally, users can configure a Nexus switch as an authoritative time server using the command ntp master. NX-OS also allows the users to specify the source interface or IP address of the NTP packets on the switch. The source of NTP packets is defined using the commands ntp source ip-address and ntp source-interface interface-id. If the configuration is specified, ensure that the NTP server is reachable via the specified IP address. These configurations are useful especially on a Nexus 7000 switch with multiple VDCs configured. On a multi-VDC Nexus 7000 switch, the hardware clock is synchronized in the default VDC, and a nondefault VDC can get the timing update from the default VDC. The nondefault VDC also acts as the server for other clients in the network after the ntp master command is configured under the VDC.
Example 2-21 demonstrates the NTP configuration on the Nexus device as a server and as a client.
Example 2-21 NTP Configuration
! NTP Server Configuration ntp peer 172.16.1.11 use-vrf management ntp source-interface mgmt0 ntp master 8
! NTP Client Configuration ntp server 172.16.1.10 prefer use-vrf management ntp server 172.16.1.11 use-vrf management ntp source-interface mgmt0
When the NTP is configured, the NTP is automatically synchronized on the client from the server. To check the status of the NTP server or peer, use the command show ntp peer-status. The * beside the peer address indicates that the NTP has synchronized with the server. Example 2-22 displays the output from both the server and the client. On the NTP server, notice that the peer address is 127.127.1.0, which means that the device itself is the NTP server. On the client, the * is beside 172.16.1.10, which is configured as the preferred NTP server in the configuration. Note that all the devices in this example are part of the same management subnet.
Example 2-22 NTP Configuration
! NTP Server Verification
NX-1# show ntp peers
--------------------------------------------------
Peer IP Address Serv/Peer
--------------------------------------------------
127.127.1.0 Server (configured)
172.16.1.11 Peer (configured)
NX-1# show ntp peer-status
Total peers : 2
* - selected for sync, + - peer mode(active),
- - peer mode(passive), = - polled in client mode
remote local st poll reach delay vrf
-----------------------------------------------------------------------------
*127.127.1.0 0.0.0.0 8 16 377 0.00000
+172.16.1.11 0.0.0.0 16 16 0 0.00000 management
! NTP Client Verification
NX-3(config)# show ntp peer-status
Total peers : 2
* - selected for sync, + - peer mode(active),
- - peer mode(passive), = - polled in client mode
remote local st poll reach delay vrf
----------------------------------------------------------------------------
*172.16.1.10 0.0.0.0 9 16 77 0.00197 management
=172.16.1.11 0.0.0.0 10 16 0 0.00000 management
After the NTP has been synchronized, the time is verified using the show clock command.
NX-OS also has a built-in proprietary feature known as Cisco Fabric Services (CFS) that can be used to distribute data and configuration changes to all Nexus devices. CFS distributes all local NTP configuration across all the Nexus devices in the network. It applies a network-wide lock for NTP when the NTP configuration is started. When the configuration changes are made, users can discard or commit the changes, and the committed configuration replicates across all Nexus devices. The CFS for NTP is enabled using the command ntp distribute. The configuration is committed to all the Nexus devices by using the ntp commit command and is aborted using the ntp abort command. When either command is executed, CFS releases the lock on NTP across network devices. To check that the fabric distribution is enabled for NTP, use the command show ntp status.
NX-OS also provides a CLI to verify the statistics of the NTP packets. Users can view input-output statistics for NTP packets, local counters maintained by NTP, and memory-related NTP counters (which is useful in case of a memory leak condition by NTP process), and per-peer NTP statistics. If the NTP packets are getting dropped for some reason, those statistics can be viewed from the CLI itself. To view these statistics, use the command show ntp statistics [io | local | memory | peer ipaddr ip-address]. Example 2-23 displays the IO and local statistics for NTP packets. If bad NTP packets or bad authentication requests are received, those counters are viewed under local statistics.
Example 2-23 NTP Statistics
NX-1# show ntp statistics io time since reset: 91281 receive buffers: 10 free receive buffers: 9 used receive buffers: 0 low water refills: 1 dropped packets: 0 ignored packets: 0 received packets: 9342 packets sent: 9369 packets not sent: 0 interrupts handled: 9342 received by int: 9342 NX-1# show ntp statistics local system uptime: 91294 time since reset: 91294 old version packets: 9195 new version packets: 0 unknown version number: 0 bad packet format: 0 packets processed: 4 bad authentication: 0