IP Services Fix · Medium ~15 min · 3 devices · 5 tasks · CCNA v2.0

NTP authentication: fix the key, the trusted key, and the server reference

R1 is supposed to sync time from NTP-SRV (10.0.99.20, a stratum-2 clock) using MD5-authenticated NTP, with key number 42 and shared value PmNtp2026. Right now R1 has ntp authentication-key 7 md5 WrongKey, no ntp trusted-key, no ntp authenticate, and the ntp server command does not reference any key. R2 only provides routing between R1 and the server. Fix the five issues and reach stratum 3.

R1 Gi0/0 10.0.12.1/30 to R2 Gi0/0 10.0.12.2/30
R2 Gi0/1 10.0.99.1/24 to NTP-SRV 10.0.99.20/24
NTP-SRV: stratum 2, key 42, MD5 PmNtp2026

Topology

Tasks

○R1 can reach the server LAN (ip route 10.0.99.0 255.255.255.0 10.0.12.2)
○Define key 42 on R1: ntp authentication-key 42 md5 PmNtp2026
○Mark key 42 trusted: ntp trusted-key 42
○Enable authentication: ntp authenticate
○Point at the server with the key: ntp server 10.0.99.20 key 42

Hints (open one at a time)

Hint 1: the four commands

Authenticated NTP needs four commands on the client: ntp authentication-key N md5 VALUE, ntp trusted-key N, ntp authenticate, and ntp server IP key N. All four must match the same N.

Hint 2: remove the wrong key

Clean up the old entry first: no ntp authentication-key 7. Leaving an unused key around does no harm, but it clouds show ntp associations detail.

Hint 3: verify

Run show ntp associations detail. The line "authenticated" should read "yes" once auth is correct, and "candidate" or "sys.peer" will mark the one R1 chose.

Full solution

R1# configure terminal
R1(config)# ip route 10.0.99.0 255.255.255.0 10.0.12.2
R1(config)# no ntp authentication-key 7
R1(config)# ntp authentication-key 42 md5 PmNtp2026
R1(config)# ntp trusted-key 42
R1(config)# ntp authenticate
R1(config)# ntp server 10.0.99.20 key 42
R1(config)# end
R1# show ntp associations detail

Authenticated NTP is a one-way check: the client validates the server. The server does not validate the client. Think of the shared key as proof the server is the one you expect, not as a login.

Stuck on a lab, or not sure what to practice next?

Talk it through with a mentor on a free 20-minute call. We look at your lab, your exam date and your weak spots, and you leave with a plan.

Book a free session

Cisco Mentorship

CompTIA Foundation

Firewall Security

Short Courses

More

CCNA v1.1

CCNA v2.0

CCNA Automation

CCNP

Network+

NSE 4

Lab Tasks

Videos

Packet Tracer Labs

Simulators

NTP authentication: fix the key, the trusted key, and the server reference

Stuck on a lab, or not sure what to practice next?