WEBVTT

1
00:00.000 --> 00:00.820 align:middle line:84%


2
00:00.820 --> 00:03.240 align:middle line:90%
(SINGING) Time keeps
on slipping, slipping,

3
00:03.240 --> 00:05.820 align:middle line:84%
slipping, into the future.

4
00:05.820 --> 00:08.460 align:middle line:90%
And then NTP steps in and
says, not if I can help it.

5
00:08.460 --> 00:10.375 align:middle line:90%
It's going to be exactly
right, no slipping.

6
00:10.375 --> 00:14.250 align:middle line:90%
In this video, I'd like to
remind you about NTP and also

7
00:14.250 --> 00:16.110 align:middle line:90%
how we can use it
with authentication

8
00:16.110 --> 00:18.200 align:middle line:90%
and also with
access control lists

9
00:18.200 --> 00:20.500 align:middle line:90%
to make it that
much more secure.

10
00:20.500 --> 00:21.793 align:middle line:84%
So let's consider NTP--

11
00:21.793 --> 00:22.710 align:middle line:84%
Network Time Protocol.

12
00:22.710 --> 00:26.100 align:middle line:90%
It works on UDP
and port number 123

13
00:26.100 --> 00:28.530 align:middle line:90%
is the well-known port
for Network Time Protocol.

14
00:28.530 --> 00:31.170 align:middle line:90%
And usually we're going to have
some type of a really trusted
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:28.530 --> 00:31.170 align:middle line:90%
And usually we're going to have
some type of a really trusted

15
00:31.170 --> 00:35.400 align:middle line:90%
NTP server that's tied
to, like, an atomic clock.

16
00:35.400 --> 00:37.800 align:middle line:90%
And that type of NTP
server that directly

17
00:37.800 --> 00:40.170 align:middle line:90%
gets its time from
an authorized clock,

18
00:40.170 --> 00:43.110 align:middle line:90%
we refer to that as
having a stratum of 1.

19
00:43.110 --> 00:45.900 align:middle line:90%
And then in our environment,
we can have one of our devices,

20
00:45.900 --> 00:50.230 align:middle line:90%
perhaps Router 1 here, that gets
its time from this NTP server.

21
00:50.230 --> 00:52.560 align:middle line:90%
So it makes requests,
gets responses.

22
00:52.560 --> 00:55.020 align:middle line:90%
And then this would
be a stratum 2.

23
00:55.020 --> 00:57.540 align:middle line:90%
Now, we could also manually
configure the routers

24
00:57.540 --> 00:59.550 align:middle line:84%
to act as a master time server.

25
00:59.550 --> 01:01.050 align:middle line:90%
We can configure
out network devices
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
00:59.550 --> 01:01.050 align:middle line:90%
We can configure
out network devices

26
01:01.050 --> 01:04.410 align:middle line:90%
to be either a server,
or a client, or a peer.

27
01:04.410 --> 01:07.200 align:middle line:90%
But having the
right time via NTP

28
01:07.200 --> 01:10.420 align:middle line:90%
is an important part regarding
secure network management.

29
01:10.420 --> 01:11.290 align:middle line:84%
So let's do this.

30
01:11.290 --> 01:14.460 align:middle line:90%
Let's actually go to Router
1, which I have in my lab.

31
01:14.460 --> 01:17.920 align:middle line:90%
And let's take a look at its
NTP commands and configuration.

32
01:17.920 --> 01:19.710 align:middle line:90%
And let's walk
through how they work.

33
01:19.710 --> 01:22.320 align:middle line:90%
The first question we can
ask this router, Router 1,

34
01:22.320 --> 01:24.510 align:middle line:90%
is are you
synchronized with NTP?

35
01:24.510 --> 01:27.540 align:middle line:90%
And to do that, we
do a show NTP status.

36
01:27.540 --> 01:28.740 align:middle line:84%
Press Enter.

37
01:28.740 --> 01:30.480 align:middle line:90%
And right here, if
it says synchronized,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:28.740 --> 01:30.480 align:middle line:90%
And right here, if
it says synchronized,

38
01:30.480 --> 01:32.580 align:middle line:84%
that's a great sign.

39
01:32.580 --> 01:36.480 align:middle line:90%
And if we do a show NTP
associations and press Enter,

40
01:36.480 --> 01:39.610 align:middle line:90%
it'll tell us who its server is
and who it's associated with.

41
01:39.610 --> 01:44.580 align:middle line:90%
So it's connecting, or it's
using 2.2.2.2 as an NTP server.

42
01:44.580 --> 01:46.850 align:middle line:90%
And then if we did a show
run, and I'll do a pipe,

43
01:46.850 --> 01:52.152 align:middle line:90%
and we'll do include NTP and
also a pipe include clock,

44
01:52.152 --> 01:54.360 align:middle line:90%
they'll show us any output
in the running config that

45
01:54.360 --> 01:57.280 align:middle line:90%
includes the word NTP
or the word clock.

46
01:57.280 --> 01:59.667 align:middle line:90%
So what I chose to do on
this system is, because I'm

47
01:59.667 --> 02:00.750 align:middle line:84%
in the Pacific time zone--
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
01:59.667 --> 02:00.750 align:middle line:84%
in the Pacific time zone--

48
02:00.750 --> 02:01.740 align:middle line:84%
I'm in Nevada.

49
02:01.740 --> 02:05.160 align:middle line:90%
I specified the time zone,
which is eight hours off of--

50
02:05.160 --> 02:08.430 align:middle line:90%
hopefully that's correct--
eight hours off of UTC.

51
02:08.430 --> 02:11.220 align:middle line:90%
I also specified that we
did that whole thing PDT--

52
02:11.220 --> 02:12.900 align:middle line:84%
Pacific Daylight Savings Time--

53
02:12.900 --> 02:13.890 align:middle line:84%
recurring.

54
02:13.890 --> 02:16.500 align:middle line:90%
And in some parts of the world
they observe Daylight Savings

55
02:16.500 --> 02:17.725 align:middle line:84%
Time, other parts they don't.

56
02:17.725 --> 02:20.100 align:middle line:90%
And even within the United
States of America there's some

57
02:20.100 --> 02:21.520 align:middle line:84%
areas that do and don't.

58
02:21.520 --> 02:24.270 align:middle line:90%
So maybe someday there won't
ever be Daylight Savings Time.

59
02:24.270 --> 02:26.580 align:middle line:90%
But as long as it's here,
we have the commands for it.

60
02:26.580 --> 02:28.915 align:middle line:90%
I've also set up
NTP authenticate,

61
02:28.915 --> 02:30.540 align:middle line:90%
which means I want
to do authentication
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
02:28.915 --> 02:30.540 align:middle line:90%
which means I want
to do authentication

62
02:30.540 --> 02:32.310 align:middle line:84%
with my NTP server.

63
02:32.310 --> 02:35.730 align:middle line:90%
And as part of that, we set
up the NTP authentication key.

64
02:35.730 --> 02:37.800 align:middle line:90%
Then I put in md5
and a password.

65
02:37.800 --> 02:40.420 align:middle line:90%
Here it actually put
the md5 hash for me.

66
02:40.420 --> 02:43.680 align:middle line:90%
And then I also specified
NTP trusted key and pointed

67
02:43.680 --> 02:45.720 align:middle line:90%
to that key that I had
defined previously.

68
02:45.720 --> 02:48.180 align:middle line:90%
If I've got some access
control lists between me

69
02:48.180 --> 02:50.790 align:middle line:90%
and the NTP server that
are looking and permitting

70
02:50.790 --> 02:53.190 align:middle line:90%
this traffic, this
NTP port 123, only

71
02:53.190 --> 02:54.960 align:middle line:90%
from certain source
addresses, I want

72
02:54.960 --> 02:56.918 align:middle line:90%
to make sure I'm sourcing
it from that address.

73
02:56.918 --> 03:00.300 align:middle line:90%
So on Router 1, I've got a
loopback address of 1.1.1.1
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

73
02:56.918 --> 03:00.300 align:middle line:90%
So on Router 1, I've got a
loopback address of 1.1.1.1

74
03:00.300 --> 03:02.190 align:middle line:90%
that's reachable
by the NTP server.

75
03:02.190 --> 03:04.907 align:middle line:90%
And I'm sourcing all my
NTP requests from that.

76
03:04.907 --> 03:06.990 align:middle line:90%
And I'm also specifying
that I should periodically

77
03:06.990 --> 03:11.580 align:middle line:90%
update my clock calendar on
my local router from NTP.

78
03:11.580 --> 03:13.290 align:middle line:90%
So once I'm
synchronized, I can also

79
03:13.290 --> 03:15.318 align:middle line:84%
synchronize my internal clock.

80
03:15.318 --> 03:16.860 align:middle line:90%
And then I'm specifying
who my server

81
03:16.860 --> 03:19.590 align:middle line:84%
is, which is server 2.2.2.2.

82
03:19.590 --> 03:22.350 align:middle line:84%
And if we did a debug of NTP--

83
03:22.350 --> 03:25.230 align:middle line:90%
and I'll do a question
mark, and I'll say all--

84
03:25.230 --> 03:27.640 align:middle line:90%
that'll give us debug
messages regarding NTP.

85
03:27.640 --> 03:30.090 align:middle line:90%
Now, one thing I want
to point out with NTP,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

85
03:27.640 --> 03:30.090 align:middle line:90%
Now, one thing I want
to point out with NTP,

86
03:30.090 --> 03:31.860 align:middle line:90%
if you're just
setting it up, I would

87
03:31.860 --> 03:34.560 align:middle line:90%
start off with the basics
with no authentication

88
03:34.560 --> 03:36.010 align:middle line:84%
and make sure it's working.

89
03:36.010 --> 03:38.700 align:middle line:90%
Then once it's working, then
you can go ahead and add onto it

90
03:38.700 --> 03:40.080 align:middle line:84%
the authentication.

91
03:40.080 --> 03:41.520 align:middle line:90%
Because one thing
I've discovered

92
03:41.520 --> 03:45.780 align:middle line:90%
is that NTP is the most
skeptical protocol ever

93
03:45.780 --> 03:46.780 align:middle line:84%
on a Cisco router.

94
03:46.780 --> 03:49.300 align:middle line:90%
So if you enable NTP, and
you say here's your server,

95
03:49.300 --> 03:50.360 align:middle line:84%
it would go, OK.

96
03:50.360 --> 03:52.770 align:middle line:90%
I want to, like, get a
whole bunch of updates

97
03:52.770 --> 03:54.120 align:middle line:84%
before I start believing that.

98
03:54.120 --> 03:56.160 align:middle line:90%
And it could take
15 to 20 minutes

99
03:56.160 --> 03:59.130 align:middle line:90%
before your local router
will then synchronize

100
03:59.130 --> 04:01.170 align:middle line:84%
its clock with the NTP server.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
03:59.130 --> 04:01.170 align:middle line:84%
its clock with the NTP server.

101
04:01.170 --> 04:03.385 align:middle line:90%
So I point that out so
that in a lab environment

102
04:03.385 --> 04:05.010 align:middle line:90%
or in production,
just be aware that it

103
04:05.010 --> 04:07.920 align:middle line:90%
might take a while for the
clock on the local router

104
04:07.920 --> 04:09.215 align:middle line:84%
to become synchronized.

105
04:09.215 --> 04:10.590 align:middle line:90%
And there's one
more thing I want

106
04:10.590 --> 04:13.890 align:middle line:90%
to share with you regarding NTP
in addition to authentication.

107
04:13.890 --> 04:16.709 align:middle line:90%
And that is using an
access control list

108
04:16.709 --> 04:20.610 align:middle line:90%
to specify who you're willing
to talk to regarding NTP.

109
04:20.610 --> 04:23.820 align:middle line:90%
And let's go over to the
NTP server, which is R2.

110
04:23.820 --> 04:26.612 align:middle line:90%
And let's turn off
debugging there.

111
04:26.612 --> 04:30.570 align:middle line:84%
Let's do a show access list.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

111
04:26.612 --> 04:30.570 align:middle line:84%
Let's do a show access list.

112
04:30.570 --> 04:33.630 align:middle line:90%
So I've got one access list
that says permit the source

113
04:33.630 --> 04:35.310 align:middle line:90%
address of 1.1.1.1,
which happens

114
04:35.310 --> 04:37.960 align:middle line:84%
to be our NTP client, R1.

115
04:37.960 --> 04:41.760 align:middle line:90%
And if we do a show run pipe
include NTP, check this out.

116
04:41.760 --> 04:46.305 align:middle line:90%
I have this command NTP
access group serve 1.

117
04:46.305 --> 04:48.180 align:middle line:90%
And if we look at the
other options for that,

118
04:48.180 --> 04:51.640 align:middle line:90%
NTP access group and put
a question mark there,

119
04:51.640 --> 04:54.220 align:middle line:90%
so the server represents that
we can provide server and query

120
04:54.220 --> 04:54.720 align:middle line:84%
access.

121
04:54.720 --> 04:57.480 align:middle line:90%
In case I want to
make R1 appear,

122
04:57.480 --> 05:00.130 align:middle line:90%
I can have server and query
access back and forth.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

122
04:57.480 --> 05:00.130 align:middle line:90%
I can have server and query
access back and forth.

123
05:00.130 --> 05:01.510 align:middle line:84%
Or I could do the serve only.

124
05:01.510 --> 05:02.885 align:middle line:90%
And that means
that it would only

125
05:02.885 --> 05:05.512 align:middle line:90%
act as a server based on that
ACL that I'm going to specify.

126
05:05.512 --> 05:06.970 align:middle line:90%
And the question
may come up, well,

127
05:06.970 --> 05:08.110 align:middle line:90%
why do we need to
lock that down?

128
05:08.110 --> 05:09.020 align:middle line:84%
What's the big deal?

129
05:09.020 --> 05:13.240 align:middle line:90%
Well, if we are an NTP servers,
so we're listening on UDP port

130
05:13.240 --> 05:17.380 align:middle line:90%
123, an attacker, what would
prevent them from just sending,

131
05:17.380 --> 05:21.760 align:middle line:90%
like, millions and millions
of NTP requests and possibly

132
05:21.760 --> 05:23.980 align:middle line:90%
causing a denial of
service or overloading

133
05:23.980 --> 05:25.750 align:middle line:84%
our service on that router?

134
05:25.750 --> 05:28.752 align:middle line:90%
So by putting in the access
control list specific for NTP,

135
05:28.752 --> 05:29.710 align:middle line:84%
it's going to go ahead.

136
05:29.710 --> 05:31.720 align:middle line:90%
And when those packets come in,
if they don't match the access
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

136
05:29.710 --> 05:31.720 align:middle line:90%
And when those packets come in,
if they don't match the access

137
05:31.720 --> 05:32.513 align:middle line:84%
list, boom.

138
05:32.513 --> 05:33.180 align:middle line:84%
They're dropped.

139
05:33.180 --> 05:34.270 align:middle line:84%
They're not processed.

140
05:34.270 --> 05:37.180 align:middle line:90%
It can help reduce the chances
of a denial of service attack

141
05:37.180 --> 05:39.140 align:middle line:84%
against our NTP server.

142
05:39.140 --> 05:41.290 align:middle line:90%
So on this server, if
we did a show control--

143
05:41.290 --> 05:45.800 align:middle line:90%
I think this is supported here--
control plane hosts open ports.

144
05:45.800 --> 05:46.760 align:middle line:84%
Yeah, right there.

145
05:46.760 --> 05:49.750 align:middle line:84%
So this guy has port 123 open.

146
05:49.750 --> 05:52.870 align:middle line:90%
It also has port
23 open for Telnet.

147
05:52.870 --> 05:56.710 align:middle line:90%
It's also got UDP 4500, in
case we're doing NAT traversal.

148
05:56.710 --> 05:59.290 align:middle line:90%
And it's also got
UDP port 500 open.

149
05:59.290 --> 06:01.930 align:middle line:90%
And that's because this
router supports IKE Phase 1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

149
05:59.290 --> 06:01.930 align:middle line:90%
And that's because this
router supports IKE Phase 1.

150
06:01.930 --> 06:03.800 align:middle line:90%
So those are all
listening ports.

151
06:03.800 --> 06:06.510 align:middle line:90%
So the ACL used in conjunction
with our NTP statement

152
06:06.510 --> 06:09.190 align:middle line:90%
is going to help prevent
a denial of service attack

153
06:09.190 --> 06:10.700 align:middle line:84%
against this router.

154
06:10.700 --> 06:13.270 align:middle line:90%
So thanks for joining me in this
video regarding Network Time

155
06:13.270 --> 06:14.030 align:middle line:84%
Protocol.

156
06:14.030 --> 06:16.030 align:middle line:90%
And in the next video,
I'd like to chat with you

157
06:16.030 --> 06:18.190 align:middle line:90%
about something very, very
critical and important

158
06:18.190 --> 06:20.470 align:middle line:90%
to the security for
network management.

159
06:20.470 --> 06:22.030 align:middle line:84%
And it is change control.

160
06:22.030 --> 06:23.870 align:middle line:90%
I'll see you there
in just a moment.

161
06:23.870 --> 06:26.280 align:middle line:90%
Meanwhile, I hope this has
been informative for you

162
06:26.280 --> 06:29.580 align:middle line:90%
and I'd like to thank
you for viewing.