CloudLabBox
Try the free demo

CCNP ENCOR lab 21 of 36

NTP hierarchy with authentication, and reading PTP

Build Fernhill's time hierarchy: a stratum 1 source, two authenticated core servers that also peer with each other, a branch client, access control and UK summer time, then read a PTP configuration the way the exam presents it.

Run this lab

It needs Lite: its 4 nodes are set to 4 vCPU and 2,048 MB in total. That fits the free demo too.

In your workspace: Shared, then CCNP ENCOR 350-401 guided labs, then 21 - NTP hierarchy with authentication and reading PTP

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 60 minutes
Nodes need
4 vCPU, 2,048 MB
Smallest plan
Lite

The scenario

Fernhill Freight's security team is investigating an incident and can't line up the log messages from different routers: every device has its own idea of the time. The data centre has a GPS-disciplined time appliance (simulated by SRC). The design:

  • R1 and R2 sync from SRC, act as peers of each other (so either can keep time if SRC fails), and serve time to the rest of the network.
  • R3 (Bristol) syncs from R1 and R2, preferring R1.
  • Every association is authenticated with MD5 key 1 (Fh-NTP-key), and all NTP traffic is sourced from Loopback0.
  • R1 and R2 only sync with SRC and each other, and only serve the 10.0.0.0/8 network.
  • All routers show UK time (GMT, with BST in summer) and stamp their logs in local time.
DeviceLo0Links
SRC10.255.0.100Gi0/0 10.0.1.1/30 → R1, Gi0/1 10.0.2.1/30 → R2
R110.255.0.1Gi0/0 10.0.1.2, Gi0/1 10.0.12.1 → R2, Gi0/2 10.0.13.1 → R3
R210.255.0.2Gi0/0 10.0.2.2, Gi0/1 10.0.12.2 → R1, Gi0/2 10.0.23.1 → R3
R310.255.0.3Gi0/0 10.0.13.2 → R1, Gi0/1 10.0.23.2 → R2

OSPF already makes every loopback reachable.

Topology: SRC at the top connects to R1 and R2; R1 and R2 connect to each other and to R3.

What you’ll practise

  • Explain NTP strata, server/client and peer associations, and why logs need one shared clock
  • Configure authenticated NTP servers, peers and clients with a fixed source interface
  • Restrict who may sync from or serve time to a router with NTP access groups
  • Set the time zone and summer time, and timestamp logs in local time
  • Interpret a PTP configuration: grandmaster, boundary and transparent clocks, BMCA priorities

The tasks

  1. Look at the clocks
  2. Secure the stratum 1 source
  3. Build the core servers and their peering
  4. Restrict NTP on the core
  5. Make Bristol a client
  6. Local time and log timestamps
  7. Interpret a PTP configuration

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of NTP hierarchy with authentication and reading PTP4 nodes, 5 links. Every link is listed as text below the diagram.SRCR1R2R3Gi0/0Gi0/0Gi0/1Gi0/0Gi0/2Gi0/0Gi0/2Gi0/1Gi0/1Gi0/1
4 nodes, with the interface names each link uses.
Every link, as text
  • SRC Gi0/0 to R1 Gi0/0
  • SRC Gi0/1 to R2 Gi0/0
  • R1 Gi0/1 to R2 Gi0/1
  • R1 Gi0/2 to R3 Gi0/0
  • R2 Gi0/2 to R3 Gi0/1
Nodes in NTP hierarchy with authentication, and reading PTP, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
SRCCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
R1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
R2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
R3Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCNP ENCOR 350-401 guided labs.

  3. Open 21 - NTP hierarchy with authentication and reading PTP and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCNP ENCOR labs

All CCNP ENCOR labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.