nexus 7000 ntp配置
C H A P T E RS e n d d o c u m e n t c o m m e n t s t o n e x u s 7k -d o c f e e d b a ck @c i s c o.c o m.3-1Cisco Nexus 7000 Series NX-OS System Management Configuration Guide, Release 5.xOL-20635-033Configuring NTPThis chapter describes how to configure the Network Time Protocol (NTP) on Cisco NX-OS devices. This chapter includes the following sections:•Information About NTP, page 3-1•Licensing Requirements for NTP, page 3-3•Prerequisites for NTP, page 3-3•Guidelines and Limitations, page 3-3 •Default Settings, page 3-4•Configuring NTP, page 3-4•Verifying the NTP Configuration, page 3-16•Configuration Examples for NTP, page 3-17•Additional References, page 3-18•Feature History for NTP, page 3-19Information About NTPThis section includes the following topics:•NTP Overview, page 3-1•NTP as Time Server, page 3-2•Distributing NTP Using CFS, page 3-2•Clock Manager, page 3-2•High Availability, page 3-3•Virtualization Support, page 3-3NTP OverviewThe Network Time Protocol (NTP) synchronizes the time of day among a set of distributed time servers and clients so that you can correlate events when you receive system logs and other time-specific events from multiple network devices. NTP uses the User Datagram Protocol (UDP) as its transport protocol. All NTP communications use Coordinated Universal Time (UTC).Chapter3 Configuring NTP Information About NTPS e n d d o c u m e n t c o m m e n t s t o n e x u s7k-d o c f e e d b a ck@c i s c o.c o m.An NTP server usually receives its time from an authoritative time source, such as a radio clock or anatomic clock attached to a time server, and then distributes this time across the network. NTP isextremely efficient; no more than one packet per minute is necessary to synchronize two machines towithin a millisecond of each other.NTP uses a stratum to describe the distance between a network device and an authoritative time source:• A stratum 1 time server is directly attached to an authoritative time source (such as a radio or atomic clock or a GPS time source).• A stratum 2 NTP server receives its time through NTP from a stratum 1 time server.Before synchronizing, NTP compares the time reported by several network devices and does notsynchronize with one that is significantly different, even if it is a stratum 1. Because Cisco NX-OScannot connect to a radio or atomic clock and act as a stratum 1 server, we recommend that you use thepublic NTP servers available on the Internet. If the network is isolated from the Internet, Cisco NX-OSallows you to configure the time as though it were synchronized through NTP, even though it was not.Note You can create NTP peer relationships to designate the time-serving hosts that you want your network device to consider synchronizing with and to keep accurate time if a server failure occurs.The time kept on a device is a critical resource, so we strongly recommend that you use the securityfeatures of NTP to avoid the accidental or malicious setting of incorrect time. Two mechanisms areavailable: an access list-based restriction scheme and an encrypted authentication mechanism. NTP as Time ServerBeginning with Cisco NX-OS Release 5.2, the Cisco NX-OS device can use NTP to distribute time.Other devices can configure it as a time server. You can also configure the device to act as anauthoritative NTP server, enabling it to distribute time even when it is not synchronized to an outsidetime source.Distributing NTP Using CFSCisco Fabric Services (CFS) distributes the local NTP configuration to all Cisco devices in the network.After enabling CFS on your device, a network-wide lock is applied to NTP whenever an NTPconfiguration is started. After making the NTP configuration changes, you can discard or commit them.In either case, the CFS lock is then released from the NTP application.For more information about CFS, see the “Configuring CFS” section on page2-1.Clock ManagerClocks are resources that need to be shared across different processes and across different VDCs.Multiple time synchronization protocols, such as NTP and Precision Time Protocol (PTP), might berunning in the system, and multiple instances of the same protocol might be running in different VDCs.Beginning with Cisco NX-OS Release 5.2, the clock manager allows you to specify the protocol and aVDC running that protocol to control the various clocks in the system. Once you specify the protocoland VDC, the system clock starts updating. For information on configuring the clock manager, see theCisco Nexus 7000 Series NX-OS Fundamentals Configuration Guide, Release 5.x.Cisco Nexus 7000 Series NX-OS System Management Configuration Guide, Release 5.xOL-20635-03Chapter3 Configuring NTPLicensing Requirements for NTPS e n d d o c u m e n t c o m m e n t s t o n e x u s7k-d o c f e e d b a ck@c i s c o.c o m. High AvailabilityStateless restarts are supported for NTP. After a reboot or a supervisor switchover, the runningconfiguration is applied. For more information on high availability, see the Cisco Nexus 7000 SeriesNX-OS High Availability and Redundancy Guide, Release 5.x.You can configure NTP peers to provide redundancy in case an NTP server fails. Virtualization SupportIf you are running a Cisco NX-OS Release prior to 5.2, up to one instance of NTP is supported on theentire platform. You must configure NTP in the default virtual device context (VDC), and you areautomatically placed in the default VDC unless you specify otherwise.If you are running Cisco NX-OS Release 5.2 or later, multiple instances of NTP are supported, oneinstance per VDC. By default, Cisco NX-OS places you in the default VDC unless you specificallyconfigure another VDC.Only one VDC (the default VDC by default) synchronizes the system clock at any given time. The NTPdaemon in all other VDCs acts only as an NTP server for the other devices. To change which VDCsynchronizes the system clock, use the clock protocol ntp vdc vdc-id command.NTP recognizes virtual routing and forwarding (VRF) instances. NTP uses the default VRF if you do notconfigure a specific VRF for the NTP server and NTP peer. See the Cisco Nexus 7000 Series NX-OSUnicast Routing Configuration Guide, Release 5.x for more information about VRFs.For more information about VDCs, see the Cisco Nexus 7000 Series NX-OS Virtual Device ContextConfiguration Guide, Release 5.x.Licensing Requirements for NTPProduct License RequirementCisco NX-OS NTP requires no license. Any feature not included in a license package is bundled with the Cisco NX-OS system images and is provided at no extra charge to you. For a complete explanation of the Cisco NX-OSlicensing scheme, see the Cisco NX-OS Licensing Guide.Prerequisites for NTPNTP has the following prerequisites:•To configure NTP, you must have connectivity to at least one server that is running NTP.•To configure VDCs, you must install the Advanced Services license. See the Cisco Nexus 7000 Series NX-OS Virtual Device Context Configuration Guide, Release 5.x. Guidelines and LimitationsNTP has the following configuration guidelines and limitations:Cisco Nexus 7000 Series NX-OS System Management Configuration Guide, Release 5.x OL-20635-03Chapter3 Configuring NTP Default SettingsS e n d d o c u m e n t c o m m e n t s t o n e x u s7k-d o c f e e d b a ck@c i s c o.c o m.•NTP server functionality is supported starting in Cisco NX-OS Release 5.2.•You should have a peer association with another device only when you are sure that your clock is reliable (which means that you are a client of a reliable NTP server).• A peer configured alone takes on the role of a server and should be used as a backup. If you have two servers, you can configure several devices to point to one server and the remaining devices topoint to the other server. You can then configure a peer association between these two servers tocreate a more reliable NTP configuration.•If you have only one server, you should configure all the devices as clients to that server.•You can configure up to 64 NTP entities (servers and peers).•If CFS is disabled for NTP, then NTP does not distribute any configuration and does not accept a distribution from other devices in the network.•After CFS distribution is enabled for NTP, the entry of an NTP configuration command locks the network for NTP configuration until a commit command is entered. During the lock, no changescan be made to the NTP configuration by any other device in the network except the device thatinitiated the lock.•If you use CFS to distribute NTP, all devices in the network should have the same VRFs configured as you use for NTP.•If you configure NTP in a VRF, ensure that the NTP server and peers can reach each other through the configured VRFs.•You must manually distribute NTP authentication keys on the NTP server and Cisco NX-OS devices across the network.Default SettingsTable3-1 lists the default settings for NTP parameters.T able3-1Default NTP ParametersParameters DefaultNTP Enabled in all VDCsNTP authentication DisabledNTP access EnabledNTP logging DisabledConfiguring NTPThis section includes the following topics:•Enabling or Disabling NTP, page3-5•Configuring the Device as an Authoritative NTP Server, page3-6•Configuring an NTP Server and Peer, page3-7•Configuring NTP Authentication, page3-10•Configuring NTP Access Restrictions, page3-11Cisco Nexus 7000 Series NX-OS System Management Configuration Guide, Release 5.xOL-20635-03S e n d d o c u m e n t c o m m e n t s t o n e x u s 7k -d o c f e e d b a ck @c i s c o.c o m.3-5Cisco Nexus 7000 Series NX-OS System Management Configuration Guide, Release 5.xOL-20635-03Chapter 3 Configuring NTPConfiguring NTP•Configuring the NTP Source IP Address, page 3-13•Configuring the NTP Source Interface, page 3-13•Configuring NTP Logging, page 3-13•Enabling CFS Distribution for NTP, page 3-14•Committing NTP Configuration Changes, page 3-15•Discarding NTP Configuration Changes, page 3-16•Releasing the CFS Session Lock, page 3-16NoteBe aware that the Cisco NX-OS commands for this feature may differ from those commands used in Cisco IOS.Enabling or Disabling NTPYou can enable or disable NTP in a particular VDC. NTP is enabled in all VDCs by default.BEFORE YOU BEGINMake sure that you are in the correct VDC. To change the VDC, use the switchto vdc command.SUMMARY STEPS1.config t2.[no] feature ntp3.(Optional) show ntp status4.(Optional) copy running-config startup-configDETAILED STEPSCommandPurposeStep 1config tExample:switch# config tEnter configuration commands, one per line. End with CNTL/Z.switch(config)#Places you in global configuration mode.Step 2[no ] feature ntpExample:switch(config)# feature ntpEnables or disables NTP in a particular VDC. NTP is enabled by default.NoteIf you are running a Cisco NX-OS Release prior to 5.2, NTP is enabled or disabled using the [no ] ntp enable command.S e n d d o c u m e n t c o m m e n t s t o n e x u s 7k -d o c f e e d b a ck @c i s c o.c o m.Cisco Nexus 7000 Series NX-OS System Management Configuration Guide, Release 5.xOL-20635-03Chapter 3 Configuring NTPConfiguring NTPThis example shows how to disable NTP:switch# config tEnter configuration commands, one per line. End with CNTL/Z.switch(config)# no feature ntpConfiguring the Device as an Authoritative NTP ServerYou can configure the device to act as an authoritative NTP server, enabling it to distribute time even when it is not synchronized to an existing time server.BEFORE YOU BEGINMake sure that you are in the correct VDC. To change the VDC, use the switchto vdc command.SUMMARY STEPS1.config t2.[no] ntp master [stratum ]3.(Optional) show running-config ntp4.(Optional) copy running-config startup-configDETAILED STEPSStep 3show ntp statusExample:switch(config)# show ntp status Distribution: EnabledLast operational state: Fabric Locked(Optional) Displays the status of the NTP application.Step 4copy running-config startup-config Example:switch(config)# copy running-config startup-config(Optional) Saves the change persistently through reboots and restarts by copying the running configuration to the startup configuration.CommandPurposeCommandPurposeStep 1config tExample:switch# config tEnter configuration commands, one per line. End with CNTL/Z.switch(config)#Places you in global configuration mode.Step 2[no ] ntp master [stratum ]Example:switch(config)# ntp masterConfigures the device as an authoritative NTP server.You can specify a different stratum level from which NTP clients get their time synchronized. The range is from 1 to 15.S e n d d o c u m e n t c o m m e n t s t o n e x u s 7k -d o c f e e d b a ck @c i s c o.c o m.Cisco Nexus 7000 Series NX-OS System Management Configuration Guide, Release 5.xOL-20635-03Chapter 3 Configuring NTPConfiguring NTPThis example shows how to configure the Cisco NX-OS device as an authoritative NTP server with a different stratum level:switch# config tEnter configuration commands, one per line. End with CNTL/Z.switch(config)# ntp master 5Configuring an NTP Server and PeerYou can configure an NTP server and peer.BEFORE YOU BEGINMake sure that you are in the correct VDC. To change the VDC, use the switchto vdc command.Make sure you know the IP address or DNS names of your NTP server and its peers.If you plan to use CFS to distribute your NTP configuration to other devices, then you should have already completed the following:–Enabled CFS distribution using the “Configuring CFS Distribution” section on page 2-6.–Enabled CFS for NTP using the “Enabling CFS Distribution for NTP” section on page 3-14.SUMMARY STEPS1.config t2.[no ] ntp server {ip-address | ipv6-address | dns-name } [key key-id ] [maxpoll max-poll ] [minpoll min-poll ] [prefer ] [use-vrf vrf-name ]3.[no ] ntp peer {ip-address | ipv6-address | dns-name } [key key-id ] [maxpoll max-poll ] [minpoll min-poll ] [prefer ] [use-vrf vrf-name ]4.(Optional) show ntp peers5.(Optional) copy running-config startup-configStep 3show running-config ntpExample:switch(config)# show running-config ntp(Optional) Displays the NTP configuration.Step 4copy running-config startup-config Example:switch(config)# copy running-config startup-config(Optional) Saves the change persistently through reboots and restarts by copying the running configuration to the startup configuration.CommandPurposeS e n d d o c u m e n t c o m m e n t s t o n e x u s 7k -d o c f e e d b a ck @c i s c o.c o m.Cisco Nexus 7000 Series NX-OS System Management Configuration Guide, Release 5.xOL-20635-03Chapter 3 Configuring NTPConfiguring NTPDETAILED STEPSCommandPurposeStep 1config tExample:switch# config tEnter configuration commands, one per line. End with CNTL/Z.switch(config)#Places you in global configuration mode.Step 2[no ] ntp server {ip-address | ipv6-address | dns-name } [key key-id ] [maxpoll max-poll ] [minpoll min-poll ] [prefer ] [use-vrf vrf-name ]Example:switch(config)# ntp server 192.0.2.10Forms an association with a server.Use the key keyword to configure a key to be used while communicating with the NTP server. The range for the key-id argument is from 1 to 65535.Use the maxpoll and minpoll keywords toconfigure the maximum and minimum intervals in which to poll a peer. The range for themax-poll and min-poll arguments is from 4 to 16 seconds, and the default values are 6 and 4, respectively.Use the prefer keyword to make this the preferred NTP server for the device.Use the use-vrf keyword to configure the NTP server to communicate over the specified VRF. The vrf-name argument can be default , management , or any case-sensitive alphanumeric string up to 32 characters.NoteIf you configure a key to be used while communicating with the NTP server, make sure that the key exists as a trusted key on the device. For more information on trusted keys, see the “Configuring NTP Authentication” section on page 3-10.S e n d d o c u m e n t c o m m e n t s t o n e x u s 7k -d o c f e e d b a ck @c i s c o.c o m.Cisco Nexus 7000 Series NX-OS System Management Configuration Guide, Release 5.xOL-20635-03Chapter 3 Configuring NTPConfiguring NTPThis example shows how to configure an NTP server and peer:switch# config tEnter configuration commands, one per line. End with CNTL/Z.switch(config)# ntp server 192.0.2.10 key 10 use-vrf Red switch(config)# ntp peer 2001:0db8::4101 prefer use-vrf Red switch(config)# show ntp peers-------------------------------------------------- Peer IP Address Serv/Peer -------------------------------------------------- 2001:0db8::4101 Peer (configured) 192.0.2.10 Server (configured) switch(config)# copy running-config startup-config [########################################] 100%switch(config)#Step 3[no ] ntp peer {ip-address | ipv6-address | dns-name } [key key-id ] [maxpoll max-poll ] [minpoll min-poll ] [prefer ] [use-vrf vrf-name ]Example:switch(config)# ntp peer 2001:0db8::4101Forms an association with a peer. You can specify multiple peer associations.Use the key keyword to configure a key to be used while communicating with the NTP peer. The range for the key-id argument is from 1 to 65535.Use the maxpoll and minpoll keywords toconfigure the maximum and minimum intervals in which to poll a peer. The range for themax-poll and min-poll arguments is from 4 to 17 seconds, and the default values are 6 and 4, respectively.Use the prefer keyword to make this the preferred NTP peer for the device.Use the use-vrf keyword to configure the NTP peer to communicate over the specified VRF. The vrf-name argument can be default , management , or any case-sensitive alphanumeric string up to 32 characters.Step 4show ntp peersExample:switch(config)# show ntp peers(Optional) Displays the configured server and peers.NoteA domain name is resolved only when you have a DNS server configured.Step 5copy running-config startup-config Example:switch(config)# copy running-config startup-config(Optional) Saves the change persistently through reboots and restarts by copying the running configuration to the startup configuration.CommandPurposeS e n d d o c u m e n t c o m m e n t s t o n e x u s 7k -d o c f e e d b a ck @c i s c o.c o m.Cisco Nexus 7000 Series NX-OS System Management Configuration Guide, Release 5.xOL-20635-03Chapter 3 Configuring NTPConfiguring NTPConfiguring NTP AuthenticationYou can configure the device to authenticate the time sources to which the local clock is synchronized. When you enable NTP authentication, the device synchronizes to a time source only if the source carries one of the authentication keys specified by the ntp trusted-key command. The device drops any packets that fail the authentication check and prevents them from updating the local clock. NTP authentication is disabled by default.BEFORE YOU BEGINMake sure that you configured the NTP server with the authentication keys that you plan to specify in this procedure. See the “Configuring an NTP Server and Peer” section on page 3-7 for information.Make sure that you are in the correct VDC. To change the VDC, use the switchto vdc command.SUMMARY STEPS1.config t2.[no ] ntp authentication-key number md5 md5-string3.(Optional) show ntp authentication-keys4.[no ] ntp trusted-key number5.(Optional) show ntp trusted-keys6.[no ] ntp authenticate7.(Optional) show ntp authentication-status 8.(Optional) copy running-config startup-configDETAILED STEPSCommandPurposeStep 1config tExample:switch# config tEnter configuration commands, one per line. End with CNTL/Z.switch(config)#Places you in global configuration mode.Step 2[no ] ntp authentication-key number md5 md5-stringswitch(config)# ntp authentication-key 42 md5aNiceKeyDefines the authentication keys. The device does not synchronize to a time source unless the source has one of these authentication keys and the key number is specified by the ntp trusted-key number command.The range for authentication keys is from 1 to 65535. Cisco NX-OS Release 5.2(3) and later 5.x releases support up to 15 alphanumeric characters for the MD5 string. Earlier releases support up to 8 alphanumeric characters.S e n d d o c u m e n t c o m m e n t s t o n e x u s 7k -d o c f e e d b a ck @c i s c o.c o m.Configuring NTPThis example shows how to configure the device to synchronize only to time sources that provide authentication key 42 in their NTP packets:switch# config tEnter configuration commands, one per line. End with CNTL/Z.switch(config)# ntp authentication-key 42 md5 aNiceKey switch(config)# ntp trusted-key 42switch(config)# ntp authenticateswitch(config)# copy running-config startup-config [########################################] 100%switch(config)#Configuring NTP Access RestrictionsYou can control access to NTP services by using access groups. Specifically, you can specify the types of requests that the device allows and the servers from which it accepts responses.If you do not configure any access groups, NTP access is granted to all devices. If you configure any access groups, NTP access is granted only to the remote device whose source IP address passes the access list criteria.BEFORE YOU BEGINMake sure that you are in the correct VDC. To change the VDC, use the switchto vdc command.Step 3show ntp authentication-keysExample:switch(config)# show ntp authentication-keys(Optional) Displays the configured NTP authentication keys.Step 4[no ] ntp trusted-key numberExample:switch(config)# ntp trusted-key 42Specifies one or more keys (defined in Step 2) that a time source must provide in its NTPpackets in order for the device to synchronize to it. The range for trusted keys is from 1 to 65535. This command provides protection against accidentally synchronizing the device to a time source that is not trusted.Step 5show ntp trusted-keysExample:switch(config)# show ntp trusted-keys(Optional) Displays the configured NTP trusted keys.Step 6[no ] ntp authenticateExample:switch(config)# ntp authenticateEnables or disables the NTP authentication feature. NTP authentication is disabled by default.Step 7show ntp authentication-status Example:switch(config)# show ntp authentication-status(Optional) Displays the status of NTP authentication.Step 8copy running-config startup-config Example:switch(config)# copy running-config startup-config(Optional) Saves the change persistently through reboots and restarts by copying the running configuration to the startup configuration.CommandPurposeS e n d d o c u m e n t c o m m e n t s t o n e x u s7k-d o c f e e d b a ck@c i s c o.c o m.Configuring NTPSUMMARY STEPS1.config t2.[no] ntp access-group {peer | serve | serve-only | query-only} access-list-name3.(Optional) show ntp access-groups4.(Optional) copy running-config startup-configDETAILED STEPSCommand PurposeStep1config tExample:switch# config tEnter configuration commands, one per line.End with CNTL/Z.switch(config)#Places you in global configuration mode.Step2[no] ntp access-group {peer | serve | serve-only | query-only} access-list-nameExample:switch(config)# ntp access-group peeraccesslist1Creates or removes an access group to control NTP access and applies a basic IP access list. The access group options are scanned in the following order, from least restrictive to most restrictive:•The peer keyword enables the device to receive time requests and NTP controlqueries and to synchronize itself to theservers specified in the access list.•The serve keyword enables the device to receive time requests and NTP controlqueries from the servers specified in theaccess list but not to synchronize itself to the specified servers.•The serve-only keyword enables the device to receive only time requests from serversspecified in the access list.•The query-only keyword enables the device to receive only NTP control queries from the servers specified in the access list.Step3show ntp access-groupsExample:switch(config)# show ntp access-groups (Optional) Displays the NTP access group configuration.Step4copy running-config startup-configExample:switch(config)# copy running-configstartup-config (Optional) Saves the change persistently through reboots and restarts by copying the running configuration to the startup configuration.S e n d d o c u m e n t c o m m e n t s t o n e x u s 7k -d o c f e e d b a ck @c i s c o.c o m.Configuring NTPThis example shows how to configure the device to allow it to synchronize to a peer from access group “accesslist1”:switch# config tswitch(config)# ntp access-group peer accesslist1switch(config)# show ntp access-groups Access List Type-----------------------------accesslist1 Peerswitch(config)# copy running-config startup-config [########################################] 100%switch(config)#Configuring the NTP Source IP AddressNTP sets the source IP address for all NTP packets based on the address of the interface through which the NTP packets are sent. You can configure NTP to use a specific source IP address.To configure the NTP source IP address, use the following command in global configuration mode:Configuring the NTP Source InterfaceYou can configure NTP to use a specific interface.To configure the NTP source interface, use the following command in global configuration mode:Configuring NTP LoggingYou can configure NTP logging in order to generate system logs with significant NTP events. NTP logging is disabled by default.BEFORE YOU BEGINMake sure that you are in the correct VDC. To change the VDC, use the switchto vdc command.CommandPurpose[no ] ntp source ip-addressExample :switch(config)# ntp source 192.0.2.1Configures the source IP address for all NTP packets. The ip-address can be in IPv4 or IPv6 format.CommandPurpose[no ] ntp source-interface interface Example :switch(config)# ntp source-interface ethernet 2/1Configures the source interface for all NTP packets. Use the ? keyword to display a list of supported interfaces.S e n d d o c u m e n t c o m m e n t s t o n e x u s 7k -d o c f e e d b a ck @c i s c o.c o m.Configuring NTPSUMMARY STEPS1.config t2.[no ] ntp logging3.(Optional) show ntp logging-status4.(Optional) copy running-config startup-configDETAILED STEPSThis example shows how to enable NTP logging in order to generate system logs with significant NTP events:switch# config tswitch(config)# ntp loggingswitch(config)# copy running-config startup-config [########################################] 100%switch(config)#Enabling CFS Distribution for NTPYou can enable CFS distribution for NTP in order to distribute the NTP configuration to other CFS-enabled devices.BEFORE YOU BEGINMake sure that you have enabled CFS distribution for the device using the “Configuring CFS Distribution” section on page 2-6.CommandPurposeStep 1config tExample:switch# config tEnter configuration commands, one per line. End with CNTL/Z.switch(config)#Places you in global configuration mode.Step 2[no ] ntp loggingExample:switch(config)# ntp loggingEnables or disables system logs to be generated with significant NTP events. NTP logging is disabled by default.Step 3show ntp logging-statusExample:switch(config)# show ntp logging-status(Optional) Displays the NTP logging configuration status.Step 4copy running-config startup-config Example:switch(config)# copy running-config startup-config(Optional) Saves the change persistently through reboots and restarts by copying the running configuration to the startup configuration.。
配置NTP服务
NTP服务概述NTP(Network Time protocol,网络时间协议)NTP协议用于同步计算机时钟NTP提供准确时间,首先需要一个准确的UTC(协议调世界时)时间来源NTP服务的时间校对方式1. broadcast/multicast : 该方式主要适用于局域网环境,时间服务器周期性地以广播的方式将时间信息传送给其他网络中的时间服务器[时间有少许延迟/配置简单/精度不高]2. symmetric : 该方式一台服务器可以从远端时间服务器获取时钟,亦可以提供是时间信息给元旦的时间服务器[适用于配置冗余时间服务器/高精度]3. client/server : 该方式由一台时间服务器接受上层时间服务器的时间信息,并提供时间信息给下层用户类似于symmetric [不对其他时间服务器提供时间信息NTP服务端口时间信息的传输是用UDP协议123端口NTP服务安装NTP服务在RHEL5.x中为默认安装的软件包[root@localhost ~]# rpm -q ntpntp-4.2.2p1-9.el5_4.1NTP服务配置NTP属于SystemV服务service ntpd start #启动service ntpd stop #停止service ntpd restart #重启service ntpd reload #重新加载service ntpd status #查看当前状态服务自动加载[root@localhost test]# chkconfig ntpd on #不指定运行级别时默认在2.3.4.5级别运行[root@localhost test]# chkconfig ntpd off[root@localhost test]# chkconfig ntpd --level 35 on #指定运行级别[root@localhost test]# chkconfig ntpd --level 35 offNTP配置文件解析[root@localhost ~]# rpm -ql ntp/etc/ntp.confrestrict字段指定可以进行NTP通信的IP地址或网段restrict <ip><netmask> | <subnet><netmask> [ignore|nomodify|noquery|notrap|notrust|nokod] ignore : 关闭所有NTP服务nomodify : 客户端不能更改NTP服务器时间参数,可以同过NTP服务进行时间校对noquery : 不提供NTP服务notrap : 不提供trap远程时间登陆功能notrust : 拒绝没有通过认证的客户端kod : 阻止Kiss of dead(一种DOS攻击)包对服务器的破坏nopeer : 不与同一层次的NTPserver进行时间信息校对若没有选项则表示对客户端无任何限制server字段指定该NTP服务器上层NTP服务器server [IP|FQDN] [prefer]prefer : 该参数设置服务器优先级最高,没有prefer参数是按照配置文件设置的服务器上下顺序fudge : 修改NTP服务器相关参数driftfile 文件名: 记录NTPserver与上层NTPserver的BIOS芯片震动周期频率的误差到相应文件broadcast网段子网掩码: 指定NTP广播的网段,不指定时向所有能访问的网段广播logfile 文件名: 指定NTP服务日志文件NTP服务器配置实例1. 实验环境:终端NTPserver IP 210.75.145.44(国家授时中心)linuxNTPserver IP eth0 192.168.0.1(虚拟机NTPserver)eth1 DHCP 自动获取桥接真实机联网windows server 2003 客户机IP 192.168.0.22. 配置修改/etc/ntp.conf如下修改/etc/ntp/step-tickers文件[root@localhost ~]# cat /etc/ntp/step-tickers210.75.145.44127.127.1.0修改/etc/sysconfig/ntpd文件SYNC_HWCLOCK=yes #允许BIOS与系统时间同步,也可通过hwclock –w命令重启NTP服务配置后查看状态[root@localhost ~]# netstat -unl | grep 123udp 0 0 221.217.90.189:123 0.0.0.0:*udp 0 0 192.168.0.1:123 0.0.0.0:*udp 0 0 127.0.0.1:123 0.0.0.0:*udp 0 0 0.0.0.0:123 0.0.0.0:*udp 0 0 fe80::20c:29ff:fe3a:f95:123 :::*udp 0 0 ::1:123 :::*udp 0 0 fe80::20c:29ff:fe3a:f8b:123 :::*udp 0 0 :::123 :::*[root@localhost ~]# ntpstatsynchronised to local net at stratum 11time correct to within 10 mspolling server every 128 s[root@localhost ~]# dateSat Feb 26 15:38:12 CST 2011[root@localhost ~]# ntpq -premote refid st t when poll reach delay offset jitter============================================================================== *LOCAL(0) .LOCL. 10 l 14 64 377 0.000 0.000 0.001windows客户机配置双击右下角时间--->点击Internet时间--->勾选”自动与Internet时间服务器同步”--->填写服务器地址--->点击”立即更新”。
(整理)ntp时间同步,各种配置方法.
ntp时间同步，各种配置方法1 Windows xp NTP服务器的配置（2003配置方式一样）1) 首先需要关闭作为NTP服务器的windows系统自带的防火墙，否则将同步不成功。
2) 单击“开始”，单击“运行”，键入regedit，然后单击“确定”。
找到下面的注册表项然后单击它：HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config\在右窗格中，右键单击“AnnounceFlags”，然后单击“修改”。
在“编辑DWORD 值”对话框中的“数值数据”下，键入5，然后单击“确定”。
3) 启用NTPServer。
a. 找到并单击下面的注册表子项：HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpSer ver\b. 在右窗格中，右键单击“Enabled”，然后单击“修改”。
c. 在“编辑DWORD 值”对话框中的“数值数据”下，键入1，然后单击“确定”。
4) 关闭NTP client找到并单击下面的注册表子项：a)HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\Ntpclie nt\b) 在右窗格中，右键单击“Enabled”，然后单击“修改”。
c) 在“编辑DWORD 值”对话框中的“数值数据”下，键入0，然后单击“确定”。
5) 退出注册表编辑器。
在命令提示符处，键入以下命令以重新启动Windows 时间服务，然后按Enter：net stop w32time && net start w32time2 Windows（2003、XP）系统的NTP同步配置2.1 Windows客户端的设置1) 首先需要关闭作为NTP客户端的windows系统自带的防火墙，否则将同步不成功。
ntp服务器配置
国家开发银行时间同步基础设施建设项目实施说明书2010年4月文档信息文档状态记录目录网络设备NTP客户端配置 (6)一、C ISCO下NTP服务客户端配置 (6)1.1思科基础网络设备配置NTP (6)1.2思科CSS11503上配置NTP (7)1.3思科CSACSE-1113-K9上配置NTP (8)1.4思科SCE上配置NTP (9)1.5思科GSS-4492R-K9上配置NTP (10)1.6思科CS-MARS-100E-K9上配置NTP (11)1.7 Call Manager配置NTP (15)二、华为设备配置NTP (17)2.1华为路由器及防火墙配置NTP (17)2.2华为NS-SecPath 100F-AC，S3900上配置NTP (18)三、联想网域防火墙的NTP配置 (20)四、启明星辰防火墙的NTP配置 (21)五、F5下的NTP配置 (22)六、网康下的NTP配置 (23)七、P OLYCOM的NTP配置 (24)主机系统NTP客户端配置 (26)一、AIX下NTP服务客户端配置 (26)二、HP-UNIX下NTP服务客户端配置 (29)三、S OLARIS下NTP服务客户端配置 (33)3.1 solaris8、9 NTP服务客户端配置 (33)3.2 solaris10 NTP服务客户端配置 (34)3.3 同步的检查 (35)四、L INUX下NTP服务客户端配置 (36)五、W INDOWS下NTP服务客户端配置 (37)5.1 Windows 98下NTP服务客户端配置 (37)5.2 Windows 2000下NTP服务客户端配置 (37)5.3 Windows XP下NTP服务客户端配置 (38)5.4 Windows 2003下NTP服务客户端配置 (38)5.5 Windows Vista下NTP服务客户端配置 (39)5.6 Windows 7下NTP服务客户端配置 (40)5.7 Windows 2008下NTP服务客户端配置 (40)六、SCO UNIX下NTP服务客户端配置 (41)网络设备NTP客户端配置一、Cisco下ntp服务客户端配置1.1思科基础网络设备配置NTP此方案包括思科路由器2600，1721，1841，2800，7609，3825，3845，7200，交换机2940，2950，2960，3550，3750，4500，6500及防火墙ASA5520，PIX上配置NTP。
Cisco Nexus 7000系列产品资料
产品资料1 核心交换机Cisco Nexus 7000系列机箱产品概述Cisco Nexus™ 7000系列交换机最大限度地集成可扩展性和运营灵活性。
Cisco Nexus 7000系列交换机是一个模块化数据中心级产品系列，适用于高度可扩展的万兆以太网网络，其交换矩阵架构的速度能扩展至15Tbps以上。
它的设计旨在满足大多数关键任务数据中心的要求，提供永续的系统运营和无所不在的虚拟化服务。
Cisco Nexus 7000系列建立在一个成熟的操作系统上，借助增强特性提供实时系统升级，以及出色的可管理性和可维护性。
它的创新设计专门用于支持端到端数据中心连接，将IP、存储和IPC（进程间通讯）网络整合到单一以太网交换架构之上。
作为第一款数据中心级交换平台，Cisco Nexus 7000系列(图1)提供集成永续性，以及专为数据中心可用性、可靠性、可扩展性和易管理性而优化的特性。
图1. Cisco Nexus 7000系列特性和优势在Cisco® NX-OS软件的支持下，Cisco Nexus 7000系列提供一系列丰富的特性，保证系统的永续运营。
有两种机箱外型可用。
∙前后通风，带10个前面板接入的垂直模块插槽和一个集成电缆管理系统，能够支持新老设施中的安装、运营和冷却。
∙18个前操作模块插槽，具有端到端通风能力，紧凑水平的外型，以及特别设计的集成线缆系统，方便操作并降低复杂性。
∙面向数据中心的高可靠性和最高可用性设计，所有接口和控制引擎模块都采取前面板接入，冗余电源、风扇和交换矩阵模块则完全采用后端接入，以确保维护过程中布线不受影响。
∙系统采用两个专用控制引擎模块；可扩展、完全分布式的交换矩阵架构最多能容纳5个后端安装的交换矩阵模块，配合机箱背板设计，整个系统能提供每插槽最高230 Gbps带宽，使10插槽外型机箱可提供7 Tbps转发能力，18插槽外型机箱可提供15 Tbps转发能力。
∙中板平面设计支持随您的需求变化进行灵活的技术升级，以及提供持续的投资保护。
ntp配置参数
ntp配置参数
NTP（Network Time Protocol）配置参数主要包括IP地址、端口号和认证模式。
1. IP地址：这是唯一标识NTP服务器的网络地址，用于将客户端配置到正确的服务器上，以便同步时间信息。
2. 端口号：NTP服务器使用UDP协议的123端口进行通信。
客户端和服务器之间的时间同步和信息交换都通过该端口进行。
3. 认证模式：NTP支持多种认证模式，例如不安全模式、对等模式和对称模式等。
选择适当的认证模式可以确保时间同步过程的安全性和可靠性。
此外，当设备采用对等体模式时，需要在主动对等体上指定被动对等体的地址，并且在被动对等体上需要执行“ntp-service enable”命令来开启NTP 服务，否则被动对等体不会处理来自主动对等体的NTP报文。
同时，主动对等体和被动对等体的时钟至少要有一个处于同步状态，否则它们的时间都将无法同步。
以上信息仅供参考，具体配置参数可能因设备或系统而异，建议参考相关设备的NTP配置手册或联系技术支持获取帮助。
思科新一代数据中心级交换机中文配置向导Nexus7000
Nexus Configuration Simple Guide目录Nexu7000缺省端口配置 (2)CMP连接管理处理器配置 (3)带外管理VRF (4)划分Nexus 7010 VDC (5)基于EthernetChannel的vPC (7)割裂的vPC：HSRP和STP (11)vPC的细部配置 (12)Nexus的SPAN (13)VDC的MGMT接口 (13)DOWN的VLAN端口 (13)Nexus的路由 (14)Nexus上的NLB (15)标识一个部件 (15)Nexus7000基本配置汇总 (16)Cisco NX-OS/IOS Configuration Fundamentals Comparison (16)Cisco NX-OS/IOS Interface Comparison (24)Cisco NX-OS/IOS Port-Channel Comparison (30)Cisco NX-OS/IOS HSRP Comparison (35)Cisco NX-OS/IOS STP Comparison (40)Cisco NX-OS/IOS SPAN Comparison (44)Cisco NX-OS/IOS OSPF Comparison (49)Cisco NX-OS/IOS Layer-3 Virtualization Comparison (54)vPC Role and Priority (61)vPC Domain ID (62)vPC Peer Link (62)Configuration for single 10 GigE Card (62)CFSoE (64)vPC Peer Keepalive or FT Link (64)vPC Ports (64)Orphan Ports with non-vPC VLANs (65)HSRP (66)HSRP Configuration and Best Practices for vPC (66)Advertising the Subnet (67)L3 Link Between vPC Peers (67)Cisco NX-OS/IOS TACACS+, RADIUS, and AAA Comparison (68)Nexus5000的配置同步 (73)初始化Nexus 2000 Fabric Module (75)Nexu7000缺省端口配置缺省时所有端口是关闭的no system default switchport shutdowncopy running-config startup-config vdc-all 存配置dir bootflash:dir bootflash://sup-standby/dir bootflash://sup-remoteshow roleshow inventory显示系统详细目录，或称为存货清单，可以看到各组件产品编号以及序列号show hardware 显示系统硬件详细信息show sprom backplane 1 显示交换机序列号show environment power 显示电源信息power redundancy-mode ps-redundant 如果没有双电网供电则使用此模式power redundancy-mode insrc-redundant 如果有双电网供电则使用此模式show module 检验各模块状态attach module slot_numberdir bootflash dir slot0:查看ACTIVE引擎的FLASH空间如果查看备份引擎的FLASH空间呢？首先attach module command to attach to the module number, and then use the dir bootflash: or dir slot0:out-of-service module slot Shutting Down a Supervisor or I/O Moduleout-of-service xbar slot Shutting Down a Fabric Moduleshow environmentshow environment temperatureshow environment fanbanner motd #Welcome to the switch#clock timezoneclock setreload 重启交换机reload module numberswitchto VDC切换至某VDC管理界面switchbackpoweroff module slot_numberno poweroff module slot_numberpoweroff xbar slot_numberCMP连接管理处理器配置CMP配置：You should also configure three IP addresses—one for each cmp-mgmt interface and one that is shared between the active and standby supervisor mgmt 0 interfaces.attach cmp 进入CMP命令输入后自动存盘，不需要copy run start通过NX-OS CLI来配置CMP1. configure terminal2. interface cmp-mgmt module slot 通过module 槽号分别为5/6来实现主备引擎上的CMP配置3. ip address ipv4-address/length4. ip default-gateway i pv4-address5. show running-config cmp通过CMP CLI来配置CMP1. attach cmp2. configure terminal3. ip default-gateway i pv4-address4. interface cmp-mgmt5. ip address ipv4-address/length6. show running-config在CMP上可执行的动作：show cp statereload cpattach cpmonitor cpping or traceroute 192.0.2.15reload system To reload the complete system, including the CMPs带外管理VRFManagement VRF and Basic ConnectivityThe management interface is, by default, part of the management VRF. The management interface “mgmt0” is the only interface allowed to be part of this VRF.The philosophy beyond Management VRF is to provide total isolation for the management trafficfrom the rest of the traffic flowing through the box by confining the former to its own forwarding table.In this step we will:- Verify that only the mgmt0 interface is part of the management VRF- Verify that no other interface can be part of the management VRF- Verify that the default gateway is reachable only using the management VRF如果想Ping 带外网管的网关等地址必须在Ping命令后面加上vrf managementping 10.2.8.1 vrf management划分Nexus 7010 VDCVDC是Nexus7000系列的特色功能。
思科Nexus_7000产品手册
15
用于光纤连接的2个I / O模块
46
46 Gbps
Fabric 1
46
Requires 43Gbps
46
92 Gbps
Fabric 2
46
230
48 Port 1GE SFP
46
138 Gbps
Fabric 3
46
46
Requires 80Gbps
184 Gbps
Fabric 4
46
230
46
187 磅
684 磅
10
模块顶杠杆
模块包含驱动杠杆，不仅帮助协调和安装模块，而且具有开关模块的功能 。如果两个模块同时按下，自动关闭模块的供电。
支持杠杆的模块:
管理引擎 交换矩阵 以太网
验证:
n7000# show Mod Ports --- ----1 32 module 1 Module-Type Model Status -------------------------------- ------------------ -----------10 Gbps Ethernet Module N7K-M132XP-12 ok
未来可支持的
高达8.2 Tbps的系统带宽（每槽230克）的功能模 块 可扩展到16 + Tbps的系统带宽
侧侧气流 所有组件冗余并支持热插拔 25U
Presentation_ID
© 2007 Cisco Systems, Inc. All rights reserved.
Cisco Confidential
14
交换矩阵
交换矩阵I
Nexus 7010 Fabric module
汇聚交换机Cisco Nexus 7000
支 持 基 于 用 户 身 份 的 IEEE 802.1x 认 支 持 基 于 用 户 身 份 的 IEEE 802.1x 认 证，支持基于用户身份进行VLAN分配， 证，支持基于用户身份进行VLAN分配， 无偏离 支持访客VLAN（Guest VLAN） 支持访客VLAN（Guest VLAN） 每接口队列≥4 每接口队列≥4 无偏离 支 持 硬 件 设 置 和 匹 配 DSCP 、 IP 支 持 硬 件 设 置 和 匹 配 DSCP 、 IP Precedence、CoS等，支持优先队列， Precedence、CoS等，支持优先队列， 无偏离 支持基于接口的流量管制（Policing） 支持基于接口的流量管制（Policing） 支 持 基 于 硬 件 的 IPv4 组 播 ， 支 持 基 于 硬 件 的 IPv4 组 播 ， 无偏离 IGMPv1,v2,v3 IGMPv1,v2,v3 支持SNMP v1、v2和v3 支持单向链路检测（UDLD） 每个10/100/1000M端口内置线缆时域反 射检测（TDR）功能，能够检测端口所 接以太网线缆的故障点位置，误差≤5 米 支持本地端口镜像技术，便于连接IDS 、协议分析仪等，支持本地端口镜像并 发组数（Session）≥2，支持远程端口 镜像技术（Remote SPAN），便于镜像 全网其它设备端口的流量到本地的IDS 和协议分析仪等 管理 支持SNMP v1、v2和v3 无偏离 支持单向链路检测（UDLD） 无偏离 每个10/100/1000M端口内置线缆时域反 射检测（TDR）功能，能够检测端口所 无偏离 接以太网线缆的故障点位置，误差≤5 米 支持本地端口镜像技术，便于连接IDS 、协议分析仪等，支持本地端口镜像并 发组数（Session）≥2，支持远程端口 无偏离 镜像技术（Remote SPAN），便于镜像 全网其它设备端口的流量到本地的IDS 和协议分析仪等
NTP网络时间服务器(时间同步装置)使用手册
NTP网络时间服务器(时间同步装置)使用手册NTP网络时间服务器(时间同步装置)使用手册1. 概述NTP网络时间服务器是一种用于同步网络中各个设备时间的重要工具。
本手册将详细介绍NTP网络时间服务器的使用方法，帮助用户准确设置和配置时间同步装置，保证网络中设备的时间始终保持一致。
2. 安装与配置2.1 硬件连接首先，将NTP网络时间服务器与网络中心交换机或路由器相连。
确保连接正常，然后将时间同步装置接通电源。
2.2 系统配置进入NTP网络时间服务器的管理界面（通常通过浏览器输入设备的IP地址进入），按照系统要求进行基本配置和初始化设置。
包括设定服务器的IP地址、子网掩码、网关等参数。
3. 时间同步设置3.1 外部时间源选择在时间同步设置中，用户可以选择适合自身需求的外部时间源。
NTP网络时间服务器支持使用GPS、卫星时间信号、国家授时中心等多种外部时间源，用户可以根据实际网络环境选择合适的时间源。
3.2 同步频率设定用户可以在时间同步设置中设定时间同步的频率。
一般建议将同步频率设置为每天一次，这样可以保证网络中设备的时间与外部时间源的同步。
4. 客户端配置为了让网络中所有客户端设备都能接收到经过时间同步的准确时间，需要对客户端设备进行配置。
4.1 Windows系统配置在Windows操作系统中，打开控制面板，选择“日期和时间”选项，然后在“Internet时间”标签下将NTP服务器地址设置为NTP网络时间服务器的IP地址。
4.2 Linux系统配置在Linux操作系统中，找到NTP配置文件（通常位于/etc/ntp.conf）并进行编辑，在文件中指定NTP服务器的IP地址。
4.3 其他系统配置其他系统根据具体操作系统版本进行相应的配置，设置NTP服务器的IP地址作为时间同步源。
5. 故障排除在使用过程中，如果发现时间同步装置存在故障，用户可以按照以下步骤进行排查和解决。
5.1 检查硬件连接首先，检查NTP网络时间服务器与网络设备的连接是否正常，确保网线连接正常，电源供应稳定。
NTP服务器配置范例及学习总结
NTP服务器配置范例及学习总结NTP（网络时间协议）是常用的网络时间同步协议，通过NTP服务器可以将计算机的系统时间同步到全球的标准时间，以确保计算机之间的时间一致性。
下面将介绍一个NTP服务器的配置范例，并总结学习经验。
一、NTP服务器的配置范例假设我们有一个Linux服务器，需要将其配置为一个NTP服务器，供其他计算机同步时间。
以下是一个简单的NTP服务器配置范例：1.安装NTP软件首先需要安装NTP软件包。
以Ubuntu为例，可以通过以下命令安装NTP：```sudo apt-get install ntp```2.配置NTP服务器```sudo vi /etc/ntp.conf```在文件中添加以下内容：```#使用本地时钟作为参考时间源server 127.127.1.0fudge 127.127.1.0 stratum 10#使用NTP服务器同步时间server iburstserver iburst#允许其他计算机同步时间restrict default nomodify notrap```3.启动NTP服务器```sudo service ntp start```4.验证NTP服务器通过以下命令验证NTP服务器是否正常工作：```ntpq -p```如果看到输出中包含一些服务器的IP地址和相关信息，则表示NTP 服务器已成功配置和启动。
二、学习总结学习和配置NTP服务器涉及以下几个方面的知识：1.NTP协议：了解NTP协议的基本原理和工作方式，以及NTP服务器的作用和功能。
2.NTP服务器的选择：选择合适的NTP服务器来同步时间，可以从互联网上的公共NTP服务器中选择，也可以使用其他可靠的时间源。
3.NTP服务器的配置：了解NTP服务器的配置文件，明确要配置的参数和选项，并进行相应的配置。
4.NTP服务器的验证：验证配置是否正确，包括启动NTP服务器、查看NTP服务器的状态和信息，确保NTP服务器正常工作。