NTP client and server
NTP strata and peering, configure a device as client and server, and verify synchronization state and associations.
Strata and operation
NTP synchronizes device clocks over UDP 123. Strata describe distance from the reference: stratum 0 = atomic/GPS clock, 1 = directly attached server, and each downstream level adds one (typical max meaningful ~15). A device can be a client of one server and a server for others simultaneously.
NTP quick facts
Time consistency matters for certificates (validity windows), log correlation across devices, and scheduled tasks. All your devices disagreeing by minutes makes cross-device troubleshooting nearly impossible.
Client/server configuration
Sync to an upstream NTP server and serve time to the LAN — Privileged EXEC → Global configuration
Cisco IOS / IOS XE
configure terminal ntp server 192.168.10.10 ntp master 4 end
show ntp status show ntp associations show clock
show ntp statusreports 'Clock is synchronized' with the stratum achieved.- Associations list the peer with a * when selected as the sync source.
ntp mastermakes the device itself a server at the given stratum — a lab/local fallback when no better source exists, not a routine necessity; a normal client can also serve downstream clients once synchronized.- Initial synchronization takes several minutes — don't judge failure too early.
Changes device configuration.
address ref clock st when poll reach delay offset dispPeer address, its source, stratum and health metrics.* 192.168.10.10 .GPS. 2 23 64 377 1.2 -3.1 2.8* = selected sync source; stratum 3 here (server's st 2 + 1).+ 192.168.10.11 192.168.10.10 3 45 64 377 2.0 5.4 3.0+ = surviving candidate, not selected.Association status characters
| Symbol | Meaning |
|---|---|
| * | Synchronized to this peer — the selected time source |
| + | Surviving candidate — usable backup |
| - | Discarded — failed selection |
| x | Falseticker — rejected as unreliable |
| . | Excess peer — not used |
- Output
- 'Clock is unsynchronized, stratum 16'
- Stratum 16 is the 'insane' marker — the device considers its source unusable.
- Check reachability of the configured server (UDP 123 must pass).
- Verify the server itself has a valid stratum — a broken upstream propagates stratum 16 downstream.
Unsynchronized at stratum 16 = server unreachable or itself unsynchronized.
Verification
Common mistakes
- Expecting instant sync — NTP takes polls to converge; give it minutes, not seconds.
- Blocking UDP 123 in the ACL — NTP never forms an association.
- Using
ntp masteralongside a good upstream — you end up preferring the local clock. - Forgetting time zones — NTP syncs UTC; local display still needs
clock timezonefor readable logs.
Observation: NTP configured 15 minutes ago; show ntp status still unsynchronized.
- UDP 123 filtered between device and server
- Server itself unsynchronized / wrong address
- Association formed but rejected (reach 0)
| Check | Indicates |
|---|---|
show ntp associations reach column | Reach 000 = no valid replies in the last eight polls → connectivity/ACL or server problem. |
| Ping/traceroute to the NTP server | Basic reachability first. |
Server's own show ntp status | An unsynchronized server can't serve useful time. |
Correction: Open the path or repoint to a working stratum source.
Reach rises (377 octal = eight successful polls — not a required target before sync) and status flips to synchronized.
Related resources
Sources
- Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
- RFC 5905 — Network Time Protocol Version 4 — reviewed 2026-11-02
- Cisco — Configuration Fundamentals Command Reference — reviewed 2026-11-02
Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.