NTP

NTP (Network Time Protocol) maintains accurate and consistent time synchronization across NX-OS devices by synchronizing with authoritative time sources through configurable server and peer relationships. It supports authentication for time source integrity, master mode with stratum configuration for local time authority, passive mode, source interface selection, access group restrictions, and logging with adjustable severity levels for time synchronization events. NTP server and peer entries provide granular control over VRF assignment, key-based authentication, preferred source selection, and configurable minimum/maximum polling intervals.

Diagram

Classes

nxos

Name	Type	Constraint	Mandatory
devices	List	devices	No
device_groups	List	device_groups	No
global	Class	global	No
templates	List	templates	No

devices (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

device_groups (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

global (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

templates (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

configuration (nxos.devices)

Name	Type	Constraint	Mandatory	Default Value
ntp	Class	ntp	No

ntp (nxos.devices.configuration)

Name	Type	Constraint	Mandatory
authenticate	Boolean	`true`, `false`	No
logging	Boolean	`true`, `false`	No
logging_level	Choice	`emergency`, `alert`, `critical`, `error`, `warning`, `notif`, `inform`, `debug`	No
master	Boolean	`true`, `false`	No
master_stratum	Integer	min: `1`, max: `15`	No
passive	Boolean	`true`, `false`	No
allow_control	Boolean	`true`, `false`	No
allow_private	Boolean	`true`, `false`	No
allow_control_rate_limit	Integer	min: `1`, max: `65535`	No
source_interface_type	Choice	`ethernet`, `loopback`, `mgmt`, `port-channel`, `vlan`, `vni`	No
source_interface_id	Any	String or Integer[min: `0`]	No
access_group_match_all	Boolean	`true`, `false`	No
access_group_peer	String		No
access_group_query_only	String		No
access_group_serve	String		No
access_group_serve_only	String		No
authentication_keys	List	authentication_keys	No
servers	List	servers	No
peers	List	peers	No

ntp (nxos.devices.configuration)

Name	Type	Constraint	Mandatory
authenticate	Boolean	`true`, `false`	No
logging	Boolean	`true`, `false`	No
logging_level	Choice	`emergency`, `alert`, `critical`, `error`, `warning`, `notif`, `inform`, `debug`	No
master	Boolean	`true`, `false`	No
master_stratum	Integer	min: `1`, max: `15`	No
passive	Boolean	`true`, `false`	No
allow_control	Boolean	`true`, `false`	No
allow_private	Boolean	`true`, `false`	No
allow_control_rate_limit	Integer	min: `1`, max: `65535`	No
source_interface_type	Choice	`ethernet`, `loopback`, `mgmt`, `port-channel`, `vlan`, `vni`	No
source_interface_id	Any	String or Integer[min: `0`]	No
access_group_match_all	Boolean	`true`, `false`	No
access_group_peer	String		No
access_group_query_only	String		No
access_group_serve	String		No
access_group_serve_only	String		No
servers	List	servers	No
peers	List	peers	No

authentication_keys (nxos.devices.configuration.ntp)

Name	Type	Constraint	Mandatory
id	Integer	min: `1`, max: `65535`	Yes
type	Choice	`md5`, `aes128cmac`	No
key	String		No
key_encryption	Choice	`0`, `6`, `7`	No
trusted	Boolean	`true`, `false`	No

servers (nxos.devices.configuration.ntp)

Name	Type	Constraint	Mandatory
ip	IP		Yes
use_vrf	String		No
key	Integer	min: `1`, max: `65535`	No
prefer	Boolean	`true`, `false`	No
minpoll	Integer	min: `4`, max: `16`	No
maxpoll	Integer	min: `4`, max: `16`	No

peers (nxos.devices.configuration.ntp)

Name	Type	Constraint	Mandatory
ip	IP		Yes
use_vrf	String		No
key	Integer	min: `1`, max: `65535`	No
prefer	Boolean	`true`, `false`	No
minpoll	Integer	min: `4`, max: `16`	No
maxpoll	Integer	min: `4`, max: `16`	No

Examples

Example 1: Basic NTP with redundant time servers

nxos:
  devices:
    - name: LEAF1
      configuration:
        ntp:
          logging: true
          servers:
            - ip: 10.50.100.1
              prefer: true
              use_vrf: management
            - ip: 10.50.100.2
              use_vrf: management

Example 2: NTP with authentication enabled for secure time synchronization

nxos:
  devices:
    - name: SPINE1
      configuration:
        ntp:
          authenticate: true
          logging: true
          authentication_keys:
            - id: 1
              type: md5
              key: NtpS3cr3t
              key_encryption: "0"
              trusted: true
          servers:
            - ip: 10.50.100.1
              prefer: true
              use_vrf: management
              key: 1
            - ip: 10.50.100.2
              use_vrf: management
              key: 1

Example 3: NTP with custom polling intervals and master fallback

nxos:
  devices:
    - name: BORDER-LEAF1
      configuration:
        ntp:
          authenticate: true
          logging: true
          master: true
          master_stratum: 8
          source_interface_type: loopback
          source_interface_id: "0"
          authentication_keys:
            - id: 1
              type: aes128cmac
              key: NtpS3cr3t
              key_encryption: "0"
              trusted: true
          servers:
            - ip: 10.50.100.1
              prefer: true
              use_vrf: management
              key: 1
              minpoll: 6
              maxpoll: 10
            - ip: 10.50.100.2
              use_vrf: management
              key: 1

Example 4: NTP with access group restrictions

nxos:
  devices:
    - name: SPINE1
      configuration:
        ip_access_lists:
          - name: NTP-PEER-ACL
            entries:
              - sequence_number: 10
                action: permit
                protocol: ip
                source:
                  prefix: 10.50.100.0
                  prefix_length: 24
          - name: NTP-SERVE-ACL
            entries:
              - sequence_number: 10
                action: permit
                protocol: ip
                source:
                  prefix: 10.0.0.0
                  prefix_length: 8
        ntp:
          authenticate: true
          logging: true
          source_interface_type: loopback
          source_interface_id: "0"
          access_group_match_all: true
          access_group_peer: NTP-PEER-ACL
          access_group_serve: NTP-SERVE-ACL
          authentication_keys:
            - id: 1
              type: md5
              key: NtpS3cr3t
              key_encryption: "0"
              trusted: true
          servers:
            - ip: 10.50.100.1
              prefer: true
              use_vrf: management
              key: 1
            - ip: 10.50.100.2
              use_vrf: management
              key: 1

Examples

Example 1: Basic NTP with redundant time servers

nxos:
  devices:
    - name: LEAF1
      configuration:
        ntp:
          logging: true
          servers:
            - ip: 10.50.100.1
              prefer: true
              use_vrf: management
            - ip: 10.50.100.2
              use_vrf: management

Example 2: NTP with authentication enabled for secure time synchronization

nxos:
  devices:
    - name: SPINE1
      configuration:
        ntp:
          authenticate: true
          logging: true
          servers:
            - ip: 10.50.100.1
              prefer: true
              use_vrf: management
              key: 1
            - ip: 10.50.100.2
              use_vrf: management
              key: 1

Example 3: NTP with custom polling intervals and master fallback

nxos:
  devices:
    - name: BORDER-LEAF1
      configuration:
        ntp:
          authenticate: true
          logging: true
          master: true
          master_stratum: 8
          source_interface_type: loopback
          source_interface_id: "0"
          servers:
            - ip: 10.50.100.1
              prefer: true
              use_vrf: management
              key: 1
              minpoll: 6
              maxpoll: 10
            - ip: 10.50.100.2
              use_vrf: management
              key: 1

Example 4: NTP with access group restrictions

nxos:
  devices:
    - name: SPINE1
      configuration:
        ip_access_lists:
          - name: NTP-PEER-ACL
            entries:
              - sequence_number: 10
                action: permit
                protocol: ip
                source_address: 10.50.100.0
                source_wildcard: 0.0.0.255
          - name: NTP-SERVE-ACL
            entries:
              - sequence_number: 10
                action: permit
                protocol: ip
                source_address: 10.0.0.0
                source_wildcard: 0.255.255.255
        ntp:
          authenticate: true
          logging: true
          source_interface_type: loopback
          source_interface_id: "0"
          access_group_match_all: true
          access_group_peer: NTP-PEER-ACL
          access_group_serve: NTP-SERVE-ACL
          servers:
            - ip: 10.50.100.1
              prefer: true
              use_vrf: management
              key: 1
            - ip: 10.50.100.2
              use_vrf: management
              key: 1