Ntp For Mpls L3Vpns - H3C SR6600-X Configuration Manual

If no NTP access control is configured, peer is granted to the local device and peer devices.
•
• If the IP address of the peer device matches a permit statement in an ACL for more than one access
right, the least restrictive access right is granted to the peer device. If a deny statement or no ACL is
matched, no access right is granted.
If no ACL is created for an access right, the associated access right is not granted.
•
If no ACL is created for any access right, peer is granted.
•
This feature provides minimal security for a system running NTP. A more secure method is NTP
authentication.
NTP authentication
Use this feature to authenticate the NTP messages for security purposes. If an NTP message passes
authentication, the device can receive it and get time synchronization information. If not, the device
discards the message. This function makes sure the device does not synchronize to an unauthorized time
server.
Figure 28 NTP authentication
Message
Sender
As shown in
1. The sender uses the MD5 algorithm to calculate the NTP message according to the key identified
by a key ID. Then, it sends the calculated digest together with the NTP message and key ID to the
receiver.
2. Upon receiving the message, the receiver performs the following actions:
a. Finds the key according to the key ID in the message.
b. Uses the MD5 algorithm to calculate the digest.
c. Compares the digest with the digest contained in the NTP message. If they are the same, the
receiver accepts the message. Otherwise, it discards the message.

NTP for MPLS L3VPNs

In an MPLS L3VPN network, the device supports multiple VPN instances when:
It functions as an NTP client to synchronize with the NTP server.
•
• It functions as a symmetric active peer to synchronize with the symmetric passive peer.
Only the client/server and symmetric active/passive modes support VPN instances. For more
information about MPLS L3VPN, VPN instance, and PE, see MPLS Configuration Guide.
As shown in
provider edge (PE) devices, and services of the two VPNs are isolated. Time synchronization between PEs
and devices of the two VPNs can be realized if you perform the following tasks:
Message
Key ID
Compute the
Digest
digest
Key value
Figure 28, NTP authentication works as follows:
Figure 29, users in VPN 1 and VPN 2 are connected to the MPLS backbone network through
Sends to the
Message
receiver
Key ID
Digest
70
Key value
Compute the
Digest
digest
Compare
Receiver