2

I have setup an NTP Server on a Windows Server 2008. The Time synchronization works with Windows Clients and Non Domain Clients but now i have switches that want to authenticate against NTP Server and sending Auth Codes. I haven't configured any NTP auth and I'm not sure if windows ntp server are able to authenticate these clients. So far i haven't figured out how to disable authentication on my switches even so i haven't enabled this feature.

Is Windows Server NTP Serber able to authenticate non-domain clients?

1 Answer 1

2

From TechNet:

The Windows Time source authenticates with a time source client. In an Active Directory forest, the Windows Time service (W32time) relies on standard domain security features to enforce the authentication of time data. The security of Network Time Protocol (NTP) packets that are sent between a domain member and a local domain controller that is acting as a time server is based on shared key authentication. The Windows Time service uses the local computer's Kerberos session key to create authenticated signatures on NTP packets that are sent across the network. When a computer requests the time from a domain controller in the domain hierarchy, the Windows Time service requires that the time be authenticated. The domain controller then returns the required information in the form of a 64-bit value that has been authenticated with the session key from the NetLogon service. If the returned NTP packet is not signed with the computer’s session key or if it is not signed correctly, the time is rejected. In this way, the Windows Time service provides security for NTP data in an Active Directory forest.

So in order to use authentication with Windows Time, you need Active Directory domain membership.

I don't believe you can disable authentication in IOS (guessing - I don't know what kind of network switch you're using) or fall back to using SNTP. So, if you have to sync this switch to this Windows Server, your only remaining option may be to disable Windows Time and install an NTP v4 server. (Which would probably negatively affect your Windows clients.)

See this Cisco post for a corroboration of what I just said:

https://supportforums.cisco.com/document/7176/ntp-common-issues-and-troubleshooting#Sync_to_W32_based_time_service_Most_Windows_Implimentations

Also see this other Serverfault post:

Cisco ASA5505 won't sync with NTP

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .