In which configuration mode is ntp server [ip] used?

The ntp server [ip] command is entered in Global Config mode on Cisco IOS devices.

SystemGlobal Config

ntp server [ip]

Configures the router to synchronize its system clock with an NTP server, ensuring accurate time for logging, authentication, and network protocols.

Definition: ntp server [ip] is a Cisco IOS global config command. Configures the router to synchronize its system clock with an NTP server, ensuring accurate time for logging, authentication, and network protocols.

Overview

The `ntp server [ip]` command in global configuration mode instructs a Cisco router to synchronize its system clock with a specified Network Time Protocol (NTP) server. Accurate time is critical for logging events with precise timestamps, authenticating routing protocols (e.g., OSPF MD5 authentication), and coordinating time-sensitive operations like digital certificate validation. NTP operates over UDP port 123 and uses a hierarchical stratum system: stratum 0 devices (atomic clocks) feed stratum 1 servers, which feed stratum 2, and so on.

A router configured as an NTP client will periodically poll the server, adjust its clock based on the server's time, and can optionally serve time to other devices. This command is typically used when you need reliable time across the network without manual intervention. Alternatives include `ntp peer` for symmetric active mode (both devices can synchronize each other) or manual `clock set` for one-off adjustments, but NTP is preferred for ongoing accuracy.

In a broader workflow, NTP configuration is often one of the first steps after basic IP connectivity, before enabling logging, AAA, or routing protocols. Important IOS behaviors: the command adds an entry to the running configuration; the router will attempt to reach the server using its configured source interface (if `ntp source` is set) or the outgoing interface; NTP traffic is not subject to routing protocol updates; and the router must have network reachability to the server. The command requires global configuration mode (privilege level 15) and does not affect other router operations until time synchronization is achieved.

The router's clock can be viewed with `show clock` and NTP associations with `show ntp associations`.

Syntax·Global Config

ntp server [ip]

When to Use This Command

Set up NTP on a router to synchronize time with a central NTP server for consistent logging across the network.
Configure multiple NTP servers for redundancy in case the primary server becomes unreachable.
Use NTP to ensure accurate timestamps for security logs and digital certificates in a corporate network.
Synchronize time on routers in a branch office with a head-end NTP server to maintain consistent time for routing protocols like OSPF.

Parameters

Parameter	Syntax	Required	Description
ip	A.B.C.D	Required	The IP address of the NTP server. This can be an IPv4 address in dotted decimal notation (e.g., 192.168.1.10). Common mistakes include using a hostname instead of an IP address (the command does not accept hostnames; use `ntp server` with a DNS name only if the router has DNS configured) or specifying a multicast address (use `ntp broadcast client` for that). Ensure the server is reachable and NTP is enabled on it.

Command Examples

Basic NTP server configuration

ntp server 192.168.1.1

This command configures the router to synchronize its clock with the NTP server at IP address 192.168.1.1. No output is displayed upon successful configuration.

Verifying NTP association after configuration

show ntp associations

  address         ref clock     st  when  poll reach  delay  offset   disp
*~192.168.1.1     .GPS.            1   23    64   377   1.234  0.123   0.456
+~10.0.0.1        .GPS.            2   12    64   377   2.345  0.234   0.567

The output shows NTP associations. The asterisk (*) indicates the current synchronization source. 'address' is the NTP server IP, 'ref clock' is the reference clock source (e.g., GPS), 'st' is stratum level (lower is better), 'when' is seconds since last sync, 'poll' is polling interval, 'reach' is reachability (377 means all 8 attempts successful), 'delay' is round-trip delay in ms, 'offset' is time difference in ms, 'disp' is dispersion in ms. Good values: low delay, offset near 0, high reach.

Understanding the Output

The 'show ntp associations' command displays the status of NTP peers. The asterisk (*) marks the server currently used for synchronization. The 'st' column shows stratum; stratum 1 is most accurate (directly connected to a reference clock).

'when' indicates seconds since the last update; a low value is good. 'poll' is the polling interval in seconds. 'reach' is an octal value; 377 (all 8 bits set) means the last 8 polls were successful.

'delay' and 'offset' should be low for accurate time; high values may indicate network issues. 'disp' is the dispersion, representing the maximum error; lower is better. If no server is selected (no asterisk), check reachability and network connectivity.

Configuration Scenarios

Configure NTP client to synchronize with a public NTP server

A branch router needs accurate time for logging and authentication. The router has internet access via a WAN link. We will configure it to use a public NTP server (e.g., 132.163.97.3, a US NIST server).

Topology

R1(Gi0/0)---Internet---(NTP Server 132.163.97.3)

Steps

1.Step 1: Enter global configuration mode: Router> enable, Router# configure terminal
2.Step 2: Configure the NTP server: Router(config)# ntp server 132.163.97.3
3.Step 3: (Optional) Set a source interface for NTP packets: Router(config)# ntp source GigabitEthernet0/0
4.Step 4: Exit configuration mode: Router(config)# end
5.Step 5: Verify synchronization: Router# show ntp status

Configuration

! Full IOS config block
Router(config)# ntp server 132.163.97.3
Router(config)# ntp source GigabitEthernet0/0
Router(config)# end

Verify: Router# show ntp status Expected output: 'Clock is synchronized, stratum 2, reference is 132.163.97.3'

Watch out: If the router's clock is too far off (more than 1000 seconds), NTP will not synchronize. Use 'clock set' to roughly set the time first, then NTP will fine-tune it.

Configure NTP client with multiple servers for redundancy

A core router in a data center requires highly reliable time. We will configure two NTP servers (one internal, one external) so that if one fails, the router can still synchronize.

Topology

R1(Gi0/0)---10.0.1.0/30---(NTP Server1 10.0.1.2)
R1(Gi0/1)---192.168.1.0/24---(NTP Server2 192.168.1.100)

Steps

1.Step 1: Enter global configuration mode: Router> enable, Router# configure terminal
2.Step 2: Configure the first NTP server: Router(config)# ntp server 10.0.1.2
3.Step 3: Configure the second NTP server: Router(config)# ntp server 192.168.1.100
4.Step 4: (Optional) Set a source interface: Router(config)# ntp source Loopback0
5.Step 5: Exit and verify: Router(config)# end, Router# show ntp associations

Configuration

! Full IOS config block
Router(config)# ntp server 10.0.1.2
Router(config)# ntp server 192.168.1.100
Router(config)# ntp source Loopback0
Router(config)# end

Verify: Router# show ntp associations Expected output: Two entries, one for each server, with reachability and stratum. The router will synchronize to the best (lowest stratum) server.

Watch out: If both servers are reachable but have different time, the router may flap between them. Use 'ntp peer' instead if you want symmetric mode, or ensure servers are consistent via the same time source.

Troubleshooting with This Command

When troubleshooting NTP synchronization, start with `show ntp status` to see if the clock is synchronized. Healthy output shows 'Clock is synchronized' along with the stratum and reference IP. If it shows 'Clock is unsynchronized', the router has not yet synced.

Next, use `show ntp associations` to see all configured servers and their status. Key fields: 'reach' (a shift register showing recent reachability, ideally 377 octal), 'poll' (poll interval in seconds), 'delay', 'offset', and 'dispersion'. A reach value of 0 means the server is unreachable.

Common symptoms: the router's clock is not updating, or syslog timestamps are wrong. This often indicates network connectivity issues (check ACLs blocking UDP 123, or firewall rules), incorrect server IP, or the server itself not responding. Use `debug ntp packets` (with caution in production) to see NTP packet exchanges.

A step-by-step diagnostic flow: 1) Verify IP connectivity to the NTP server using `ping` and `telnet` (port 123 is UDP, so use `extended ping` with UDP port 123 or a tool like `ntpdate`). 2) Check if NTP is allowed on any interface ACLs. 3) Ensure the router's clock is not too far off (use `clock set` to approximate). 4) Verify the NTP server is configured correctly (e.g., on a Cisco server, `ntp master` must be set). 5) Check `show ntp associations detail` for per-server statistics. Correlate with `show logging` to see if timestamps are correct after sync. If the router is also acting as an NTP server for other devices, use `show ntp sessions` to see clients.

Remember that NTP uses UDP and is connectionless; lack of response may be due to asymmetric routing or NAT. Also, if the router has multiple NTP servers, it will select the best based on stratum and synchronization distance; use `show ntp associations` to see which is selected (indicated by an asterisk).

CCNA Exam Tips

CCNA exam tip: NTP uses UDP port 123; ensure ACLs allow this traffic.

CCNA exam tip: The 'ntp server' command is configured in global config mode; verify with 'show ntp status'.

CCNA exam tip: Stratum levels: 1 is most accurate, 16 is unsynchronized; routers typically operate at stratum 2-10.

CCNA exam tip: Use 'ntp peer' for symmetric active mode (not in CCNA scope), but know the difference.

Common Mistakes

Mistake: Forgetting to configure 'ntp update-calendar' to update the hardware clock; the system clock resets after reboot.

Mistake: Using an incorrect or unreachable NTP server IP; verify connectivity with 'ping'.

Mistake: Not allowing NTP through ACLs; the router will not synchronize.

ntp server [ip] vs show ntp associations

These two commands are often considered together because both are essential for NTP operation, but one is for configuration and the other for verification. Confusion arises because they both involve NTP associations, yet they serve distinct purposes: defining time sources versus checking synchronization status.

Aspect	ntp server [ip]	show ntp associations
Scope	Configure NTP server	Display NTP association status
Configuration mode	Global configuration	Privileged EXEC
Persistence	Saved to running-config	Not saved; output only
Typical use	Initial setup or adding NTP source	Troubleshooting or monitoring sync
Output	No immediate output (config command)	Table with peer status, stratum, delay, etc.
Impact on system	Changes NTP operation	Read-only; no impact

Use ntp server [ip] to define the time source the router will synchronize with, typically during initial configuration or when adding a new NTP server.

Use show ntp associations to verify the synchronization status, check which server is currently being used, and diagnose NTP issues such as unreachable or unsynchronized peers.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 switches), the `ntp server` command syntax is identical, but output formats may differ slightly (e.g., `show ntp associations` may include additional fields like 'refid'). On NX-OS (e.g., Nexus switches), the equivalent command is `ntp server [ip]` under `configure terminal`, but NX-OS also supports `ntp peer` and uses a different NTP implementation (ntpd). For example: `switch(config)# ntp server 10.1.1.1`.

Verification commands on NX-OS include `show ntp peers` and `show ntp status`. On ASA firewalls, NTP client configuration is done via `ntp server [ip]` in global configuration mode, but the ASA also requires `clock timezone` and `clock summer-time` for proper display. ASA versions 9.x support NTPv4.

In older IOS versions (12.x), the command is the same, but `show ntp associations` output may be less detailed. IOS-XR (e.g., ASR 9000) uses a different NTP configuration model: `ntp server [ip]` under `configure` but with additional parameters like `version` and `source`. For example: `RP/0/RSP0/CPU0:router(config)# ntp server 10.1.1.1 source GigabitEthernet0/0/0/0`.

Always check the specific platform documentation for exact syntax and capabilities.

Related Commands

show ntp associations

Displays the status of NTP associations configured on the device, used to verify NTP synchronization and identify time sources.

show ntp status

Displays the current NTP synchronization status, including clock stratum, reference clock, and synchronization state, used to verify NTP operation and clock accuracy.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions