VMware ESXi and vSphere Cluster Management

Configure NTP on Cisco Routers and Switches

Learn how to configure Cisco IOS devices as NTP clients or local NTP masters, select NTP version 3, and verify synchronization with Cisco show commands.

Network Time Protocol (NTP) synchronizes clocks across devices connected by IP networks. A Cisco router or switch can obtain time from an NTP server, or it can advertise its own clock as a local NTP master for other devices.

This guide covers Cisco IOS configuration, NTP version selection, verification, and basic troubleshooting. It assumes familiarity with Cisco IOS command modes, IPv4 addressing, routing, and basic show commands.

Why NTP Matters

NTP is an application-layer protocol used to align device clocks with a common time source. Clock synchronization does not necessarily make every device display the same time instantaneously, but it keeps their clocks close enough for operational tasks.

Consistent time is important for:

• Correlating events across router, switch, firewall, server, and application logs.
• Investigating outages and security incidents in the correct sequence.
• Maintaining reliable security records and audit trails.
• Validating time-dependent certificates and authentication processes.
• Running scheduled jobs and network operations at the intended times.

When devices have different clocks, an administrator may see a login failure recorded before the login attempt, or a routing event appear to occur after a later recovery event. Inconsistent timestamps make troubleshooting, incident response, and compliance reporting much harder.

The NTP Client-Server Model

An NTP server supplies time information. An NTP client requests or receives that information and adjusts, or synchronizes, its local clock. A Cisco router or switch can be an NTP client of an upstream server and can also provide time to downstream clients.

A reference clock or reference source is the upstream source from which an NTP device derives its time. An externally synchronized source may ultimately obtain time from a reliable source such as a Global Positioning System receiver or an organization-operated time service.

A Cisco NTP master is different. The ntp master configuration makes the Cisco device advertise its local clock as an NTP source. This is useful when an external source is unavailable, but the local clock is not automatically authoritative merely because the device is configured as a master.

Stratum

Stratum is an NTP hierarchy value indicating the distance from a reference time source. Lower stratum values are generally closer to an authoritative source. A device synchronized directly to a reliable reference has a lower stratum than a device that receives time from that device.

A locally configured NTP master can provide a stable time source for an isolated network, but its stratum and clock quality do not mean that it is synchronized with an external authoritative source. Use an external or internally managed synchronized source whenever the network design requires accurate, traceable time.

Configure a Cisco Device as an NTP Client

To configure a Cisco router or switch as an NTP client, enter global configuration mode and identify the IPv4 address of a reachable NTP server.

Router> enable
Router# configure terminal
Router(config)# ntp server 192.168.5.27
Router(config)# end

The command tells the device to use 192.168.5.27 as an NTP time source. The address must be reachable through the device's routing and interface configuration. Configuring the command alone does not guarantee synchronization.

Where the design provides multiple suitable sources, configure more than one server for resilience:

Router(config)# ntp server 192.168.5.27
Router(config)# ntp server 192.168.5.28

Multiple sources give the device alternatives if one server is unavailable. Select sources that are reliable, reachable, and approved for use in the network.

Configure an Explicit NTP Version

An NTP version identifies the protocol version used when the Cisco device communicates with a configured server. Normally, the version should match the compatibility requirements of the time source and the network design.

To specify NTP version 3, append version 3 to the server command:

Router> enable
Router# configure terminal
Router(config)# ntp server 192.168.5.27 version 3
Router(config)# end

Use an explicit version when the server or an interoperability requirement calls for it. Do not select a version arbitrarily; confirm the supported version and security or policy requirements of the configured time source.

Configure a Cisco Device as an NTP Master

When no external NTP source is available, a Cisco device can provide time to other devices by operating as a local NTP master.

Router> enable
Router# configure terminal
Router(config)# ntp master
Router(config)# end

This command makes the device advertise its local clock as an NTP time source. Downstream routers and switches can then configure the IP address of a reachable routed or management interface on this device:

Switch> enable
Switch# configure terminal
Switch(config)# ntp server 192.168.10.1
Switch(config)# end

In this example, 192.168.10.1 must be the address of the Cisco device configured as the local NTP master, and the client must have Layer 3 connectivity to that address.

Configuration and Verification Commands

Verify NTP Operation

After configuration, use the NTP status command:

Router# show ntp status

Look for an indication that the clock is synchronized. The exact output wording can vary by Cisco IOS release, but the important fields include:

• Synchronization state: Confirms whether the local clock is synchronized rather than merely configured with an NTP server.
• Reference source: Identifies the upstream address or source being used for time.
• Stratum: Shows the device's position in the NTP hierarchy.

Use the following commands as complementary checks:

Router# show ntp associations
Router# show clock

show ntp associations helps identify whether the configured source is reachable and being considered by NTP. show clock confirms the current local time, while show ntp status confirms whether that time is synchronized.

Example Status Interpretation

Router# show ntp status
Clock is synchronized, stratum 3, reference is 192.168.5.27

This example indicates that the device is synchronized, is three levels from its reference source, and is currently using 192.168.5.27. A status that says the clock is unsynchronized requires further investigation even if an NTP server statement appears in the configuration.

Basic NTP Troubleshooting

The Device Is Not Synchronized

If the device does not report synchronization, work through these checks:

1. Test IP reachability to the configured NTP server using the available connectivity tools and routing information.
2. Review the configured server address and confirm that it is correct.
3. Run show ntp status and show ntp associations to determine whether the source is being contacted and selected.
4. Confirm that the NTP server itself is available and synchronized to a suitable reference.
5. Check access control lists, firewalls, and other filtering policies that could block NTP traffic.
6. Confirm that the NTP version matches the server's compatibility requirements.
7. Allow time for NTP polling and source selection, then check status again.

A Downstream Client Cannot Use the Cisco Master

When a client cannot synchronize with a Cisco device intended to provide local time, check the following:

• Confirm that ntp master is configured on the intended Cisco time source.
• Confirm that the client uses the correct IP address of a routed or management interface on that device.
• Verify Layer 3 connectivity and routing between the client and the master.
• Check ACLs, firewalls, and other policies for blocked NTP traffic.
• Verify the master's own clock and NTP status. A master without an external reference may still provide time, but its accuracy is limited by its local clock.

The Association Is Visible but Synchronization Does Not Occur

An NTP source can appear in the association output without becoming the synchronized reference. Confirm the configured NTP version, evaluate the source's synchronization quality and stratum, and allow sufficient time for polling and source selection. Then repeat show ntp status and show ntp associations.

NTP Client Versus NTP Master

Practical Configuration Checklist

1. Identify an approved NTP source and its IPv4 address.
2. Confirm IP connectivity and routing to the source.
3. Enter global configuration mode with configure terminal.
4. Configure ntp server IP_ADDRESS, adding another server when resilience is appropriate.
5. Specify version 3 when required by compatibility or design.
6. If no external source is available, consider ntp master and document the accuracy limitation.
7. Exit configuration mode and run show ntp status.
8. Use show ntp associations and show clock to supplement the status check.

Exam-Relevant Notes

• NTP is an application-layer protocol for synchronizing clocks over IP networks.
• An NTP client receives time from an NTP server; a Cisco device can perform either role.
• ntp server is entered in global configuration mode.
• ntp server 192.168.5.27 version 3 explicitly selects NTP version 3.
• ntp master advertises the local Cisco clock as a time source.
• show ntp status is the primary command for determining synchronization state.
• Reference source and stratum are important status indicators.
• A configured NTP server is not necessarily a synchronized NTP server; verify the operational state.

For related Cisco configuration practice, see Configure NTP on a Cisco Device.