In which configuration mode is show ntp associations used?

The show ntp associations command is entered in Privileged EXEC mode on Cisco IOS devices.

SystemPrivileged EXEC

show ntp associations

Displays the status of NTP associations configured on the device, used to verify NTP synchronization and identify time sources.

Definition: show ntp associations is a Cisco IOS privileged exec command. Displays the status of NTP associations configured on the device, used to verify NTP synchronization and identify time sources.

Overview

The 'show ntp associations' command is a critical diagnostic tool for any network engineer working with Cisco IOS devices. It displays the status of all configured Network Time Protocol (NTP) associations, showing whether the device is synchronized to a time source, the stratum level of each source, and the reachability and delay metrics. NTP is fundamental to network operations because accurate timekeeping is essential for log correlation, certificate validation, authentication protocols (like Kerberos), and consistent timestamps in syslog and debug output.

Without synchronized time, troubleshooting becomes nearly impossible as events across devices cannot be ordered correctly. This command is typically the first step when verifying NTP configuration; alternatives like 'show ntp status' provide a summary of the local clock state, while 'show ntp associations detail' gives per-association statistics. In a broader workflow, you would use this command after configuring NTP peers or servers to confirm that the device has selected a synchronization source and that the association is active.

It is also used during troubleshooting when logs show time discrepancies or when devices fail to authenticate via time-sensitive protocols. The command runs in privileged EXEC mode (enable) and does not require any additional privilege levels. Its output is buffered and can be captured for analysis.

Importantly, this command does not alter the running configuration; it is purely a show command. Understanding the output fields—such as the clock stratum, reachability (1-377 octal), delay, offset, and dispersion—is key to diagnosing NTP issues. For example, a reach value of 377 indicates perfect reachability, while 0 means no responses received.

The command also indicates whether the association is configured (static) or dynamically learned (dynamic). In modern IOS versions, the output has been enhanced to show the NTP version and mode (client, server, peer). This command is indispensable for CCNA and CCNP candidates who must master NTP as part of the curriculum, as it appears in both exam scenarios and real-world network operations.

Syntax·Privileged EXEC

show ntp associations

When to Use This Command

Verify that the router is synchronized to an NTP server after configuration.
Troubleshoot time synchronization issues when logs show incorrect timestamps.
Check the stratum level of NTP peers to ensure accurate time source hierarchy.
Monitor NTP associations during network maintenance to confirm redundancy.

Command Examples

Basic NTP associations display

show ntp associations

  address         ref clock     st  when  poll reach  delay  offset   disp
*~192.168.1.10    .GPS.            1   23    64   377   0.512  0.123   0.015
+~10.0.0.1        .LOCL.           8   12   128   377   1.023  0.456   0.032
 ~192.168.2.20    .NIST.           2    -    64     0   0.000  0.000 16000.0
 * sys.peer, # selected, + candidate, - outlyer, ~ configured

Line 1: Header. Line 2: * indicates sys.peer (synchronized), ~ configured, address 192.168.1.10, ref clock .GPS. (stratum 1 GPS), st=1, when=23 sec ago, poll=64 sec, reach=377 (good), delay=0.512ms, offset=0.123ms, disp=0.015ms. Line 3: + candidate peer, ~ configured, 10.0.0.1 with stratum 8 local clock, reach=377, offset 0.456ms. Line 4: ~ configured but unreachable (reach=0), disp=16000 (high dispersion). Legend explains symbols.

NTP associations with detail

show ntp associations detail

192.168.1.10 configured, our_master, sane, valid, stratum 1
ref ID .GPS., time D6A1B2C3.45678901 (13:45:23.123 UTC Mon Jan 15 2024)
our mode client, peer mode server, our poll intvl 64, peer poll intvl 64
root delay 0.00 msec, root disp 0.02 msec, reach 377, sync dist 0.015
 delay 0.512 msec, offset 0.123 msec, dispersion 0.015 msec
 precision 2**16, version 4
org time D6A1B2C3.45678901
rec time D6A1B2C3.45678901
 xmt time D6A1B2C3.45678901
filtdelay =     0.51    0.52    0.53    0.51    0.50    0.52    0.51    0.53
filtoffset =    0.12    0.13    0.12    0.11    0.12    0.13    0.12    0.11
filterror =     0.02    0.03    0.02    0.02    0.03    0.02    0.03    0.02

Shows detailed per-association info: configured, our_master (synchronized), stratum 1, ref ID .GPS., timestamps, poll intervals, reach 377 (good), delay and offset values, and filter data showing recent samples. Good values: low delay/offset, reach 377, stratum low. Bad: reach 0, high dispersion.

Understanding the Output

The 'show ntp associations' output displays each configured NTP peer or server. The first character indicates status: '*' means the peer is the system peer (synchronized to), '#' is selected but not sys.peer, '+' is a candidate, '-' is outlyer, '~' is configured. 'address' is the NTP server IP.

'ref clock' shows the reference clock source (e.g., .GPS., .LOCL.). 'st' is stratum level (1 is most accurate, 16 is unsynchronized). 'when' is seconds since last packet received.

'poll' is poll interval in seconds. 'reach' is an octal reachability register (377 = 8 successful polls). 'delay' is round-trip delay in ms, 'offset' is time difference in ms, 'disp' is dispersion in ms.

For a healthy association, look for '*' or '+', reach near 377, low delay and offset (<10ms typical), and low dispersion. High dispersion (>1000) or reach 0 indicates problems. The detail view adds timestamps, filter data, and synchronization state.

Configuration Scenarios

Configure NTP client to synchronize with a public NTP server

A branch router needs to synchronize its clock with a reliable external time source to ensure accurate logging and authentication. The router will act as an NTP client to a public server (e.g., 192.168.1.10 is used as a stand-in for a public server).

Topology

R1(Gi0/0)---192.168.1.0/24---(Gi0/0)NTP_Server

Steps

1.Step 1: Enter privileged EXEC mode: Router> enable
2.Step 2: Enter global configuration mode: Router# configure terminal
3.Step 3: Configure the NTP server: Router(config)# ntp server 192.168.1.10
4.Step 4: (Optional) Configure NTP authentication if required: Router(config)# ntp authenticate, Router(config)# ntp authentication-key 1 md5 cisco123, Router(config)# ntp trusted-key 1
5.Step 5: Exit configuration mode: Router(config)# end
6.Step 6: Verify NTP associations: Router# show ntp associations

Configuration

!
configure terminal
ntp server 192.168.1.10
end

Verify: Router# show ntp associations address ref clock st when poll reach delay offset disp *~192.168.1.10 .GPS. 1 10 64 377 1.2 0.35 0.8 * sys.peer, # selected, + candidate, - outlyer, ~ configured Note: The asterisk (*) indicates the current synchronization source.

Watch out: Ensure that the NTP server IP is reachable and that UDP port 123 is not blocked by ACLs. Also, if authentication is configured, the key must match on both sides.

Configure NTP peer association between two routers for redundancy

Two core routers in a data center need to synchronize time with each other to provide redundancy. If one loses external connectivity, the other can still maintain accurate time. Both routers will be configured as NTP peers.

Topology

R1(Gi0/0)---10.0.12.0/30---(Gi0/0)R2

Steps

1.Step 1: On R1, enter global configuration mode: R1# configure terminal
2.Step 2: Configure R1 as an NTP peer to R2: R1(config)# ntp peer 10.0.12.2
3.Step 3: Configure R1 as an NTP server to R2 (optional but common): R1(config)# ntp server 10.0.12.2
4.Step 4: Exit and save: R1(config)# end, R1# write memory
5.Step 5: Repeat on R2 with the IP of R1 (10.0.12.1): R2(config)# ntp peer 10.0.12.1
6.Step 6: Verify on both routers: show ntp associations

Configuration

! On R1
configure terminal
ntp peer 10.0.12.2
end
! On R2
configure terminal
ntp peer 10.0.12.1
end

Verify: R1# show ntp associations address ref clock st when poll reach delay offset disp *~10.0.12.2 10.0.12.2 2 5 64 377 0.5 0.10 0.2 * sys.peer, # selected, + candidate, - outlyer, ~ configured Both routers should show each other as peers with reach 377.

Watch out: NTP peers should have the same stratum level or be configured to avoid synchronization loops. Use 'ntp peer' on both sides, not 'ntp server', to establish symmetric active mode. Also, ensure that the routers can reach each other on UDP 123.

Troubleshooting with This Command

When troubleshooting NTP issues, the 'show ntp associations' command is your first line of defense. A healthy output shows at least one association with an asterisk (*) next to the address, indicating the selected synchronization source. The reach field should be 377 (octal) meaning all eight recent polls were successful.

The delay should be low (typically <10 ms for local networks), offset close to zero, and dispersion small. Problem indicators include: no asterisk (no synchronization), reach value of 0 (no responses), high delay or offset (network congestion or asymmetric paths), or high dispersion (unstable source). If the output shows only '~' (configured) but no '*', the device has not synchronized; check connectivity and NTP server status.

If the reach is 0, verify that UDP 123 is not blocked and that the server is reachable via ping. If the offset is large (e.g., >1000 ms), the clock may be drifting; consider using 'ntp update-calendar' to sync the hardware clock. A step-by-step diagnostic flow: 1) Run 'show ntp associations' to see all configured sources. 2) Check if any source has a '*'—if not, run 'show ntp status' to see the local clock state. 3) If the clock is unsynchronized, verify network connectivity to the NTP server using extended ping with source interface. 4) Check ACLs on the path and on the device itself (e.g., 'show ip access-lists'). 5) If authentication is configured, verify keys with 'show ntp authentication-keys'. 6) Use 'debug ntp all' cautiously to see NTP packets (note: this can be CPU-intensive).

Correlate 'show ntp associations' with 'show ntp status' to see stratum and reference clock. Also, 'show clock detail' shows the current time and whether it is authoritative. In multi-vendor environments, ensure NTP versions match (v3 or v4).

Remember that NTP uses UDP 123 and that the device must have a valid source interface (use 'ntp source' if needed).

CCNA Exam Tips

CCNA exam may ask which symbol indicates the router is synchronized to an NTP server: answer is '*' (sys.peer).

Know that reach value 377 (octal) means all last 8 polls were successful; any lower value indicates packet loss.

Stratum 1 is the most accurate (directly from atomic clock); stratum 16 means unsynchronized.

The 'show ntp status' command is often tested alongside to verify synchronization state.

Common Mistakes

Confusing the '*' symbol with '+' or '#'; only '*' means the router is synchronized to that peer.

Assuming a reach value of 1 means good; actually 377 is perfect, lower values indicate issues.

Forgetting that NTP uses UDP port 123; ACLs or firewalls blocking it cause reach=0.

show ntp associations vs show ntp status

These two commands are often confused because both display NTP-related information, but they serve distinct purposes: show ntp associations details the configured peers/servers and their reachability, while show ntp status provides the overall synchronization state and clock stratum.

Aspect	show ntp associations	show ntp status
Information Provided	Lists all configured NTP peers/servers with stratum, delay, offset, and poll interval.	Shows local clock stratum, reference clock ID, synchronization state, and time since last sync.
Output Detail	Per-association status including reachability, authentication, and time since last update.	Single summary of system NTP status.
Use Case	Verifying NTP server connectivity and which server is being referenced.	Quickly checking if NTP is synchronized and the clock accuracy.
Key Fields	address, ref clock, st, when, poll, reach, delay, offset.	clock is synchronized, stratum, reference ID.
Troubleshooting Focus	Identifying failed or unreachable NTP sources.	Determining overall NTP synchronization health and stratum level.

Use show ntp associations when you need to inspect individual NTP peer status and identify which server is providing time.

Use show ntp status when you need a quick overview of whether the device is synchronized and its clock stratum.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 switches), the 'show ntp associations' command syntax and output are largely identical to classic IOS. However, IOS-XE may display additional fields like 'mode' (client, server, peer) and 'version' (3 or 4). On NX-OS (Cisco Nexus switches), the equivalent command is 'show ntp peers' or 'show ntp associations' (both work).

NX-OS output includes similar fields but uses different formatting; for example, it shows 'peer' instead of '~' and uses decimal reach instead of octal. On ASA firewalls, the command is 'show ntp associations' as well, but the output is more limited; ASAs typically only support NTP client mode. For IOS-XR (Cisco routers running IOS-XR), the command is 'show ntp associations' but the output is quite different, showing a table with 'Peer IP Address', 'Ref Clock', 'Stratum', 'Reachability', 'Poll', 'Delay', 'Offset', 'Disp'.

IOS-XR also requires the 'ntp' process to be running. In older IOS versions (12.x), the output may not show the '~' symbol for configured associations; instead, it uses '#' for selected. In 15.x and later, the output is more consistent.

Always check the specific platform documentation, but the core fields remain the same across platforms.

Related Commands

clock set [hh:mm:ss] [day] [month] [year]

Sets the system clock on a Cisco IOS device from the privileged EXEC mode, used to manually configure the router's time when NTP is not available.

show ntp status

Displays the current NTP synchronization status, including clock stratum, reference clock, and synchronization state, used to verify NTP operation and clock accuracy.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions