交换机配置NTP访问控制权限后时间无法同步经验案例

末端思科交换机无法通过中间H3C交换机同步时间，在H3C交换机上配置NTP权限控制之后，思科交换机无法同步时间。

现场反馈，H3C交换机按照如下配置，思科设备无法ntp同步，但是把思科地址由server指定为peer权限之后就可以同步。

ntp-service enable

ntp-service source GigabitEthernet1/0/48

ntp-service server acl 2000

ntp-service peer acl 2001

ntp-service unicast-server 192.168.3.2

#

acl number 2000

rule 0 permit source 192.168.2.1 0

#

acl number 2001

rule 0 permit source 192.168.3.2 0

在H3C交换机上debug，发现思科交换机发送的报文确实没有回复。

packet from 192.168.2.1 to 192.168.2.2 on Vlan-interface200

 leap: 3, version: 4, mode: 3, vrfindex: 0

 stratum: 16, poll: 6, precision: 2^-6

 rdel: 0.000, rdsp: 13.565, refid: INIT

 reftime: e6612113.c8312910  Sat, Jun 25 2022 13:52:19.782

 orgtime: 00000000.00000000  Thu, Feb  7 2036 14:28:16.000

 rectime: 00000000.00000000  Thu, Feb  7 2036 14:28:16.000

 xmttime: e661265d.c5e35618  Sat, Jun 25 2022 14:14:53.773

 inptime: e6612797.e5f328a4  Sat, Jun 25 2022 14:20:07.898

*Jun 25 14:20:07:898 2022 Server NTP/7/ACL: Access restrict: 0x00000000.

*Jun 25 14:20:23:070 2022 Server NTP/7/PACKET_SEND:

 packet to 192.168.3.2, length: 48

 leap: 0, version: 4, mode: 3, vrfindex: 0

 stratum:  9, poll: 6, precision: 2^-20

 rdel: 1.175, rdsp: 16.998, refid: 192.168.3.2

 reftime: e6612763.1290f273  Sat, Jun 25 2022 14:19:15.072

 orgtime: e6612763.12621219  Sat, Jun 25 2022 14:19:15.071

 rectime: e6612763.1290f273  Sat, Jun 25 2022 14:19:15.072

 xmttime: e66127a7.11ed37fe  Sat, Jun 25 2022 14:20:23.070

*Jun 25 14:20:23:072 2022 Server NTP/7/PACKET_RECV:

 packet from 192.168.3.2 to 192.168.3.1 on GigabitEthernet1/0/48

 leap: 0, version: 4, mode: 4, vrfindex: 0

 stratum:  8, poll: 6, precision: 2^-20

 rdel: 0.000, rdsp: 11.475, refid: 127.127.1.0

 reftime: e6612781.2f01fcef  Sat, Jun 25 2022 14:19:45.183

 orgtime: e66127a7.11ed37fe  Sat, Jun 25 2022 14:20:23.070

 rectime: e66127a7.120e6ce8  Sat, Jun 25 2022 14:20:23.070

 xmttime: e66127a7.12470b4a  Sat, Jun 25 2022 14:20:23.071

 inptime: e66127a7.12787e14  Sat, Jun 25 2022 14:20:23.072

*Jun 25 14:20:23:072 2022 Server NTP/7/ACL: Access restrict: 0x00000008.

*Jun 25 14:20:23:072 2022 Server NTP/7/AUTH: Received a packet at 102263, from 192.168.3.2, mode 4, key ID 00000000, length 48, authentication result 0

*Jun 25 14:20:23:072 2022 Server NTP/7/PARAM: Clock filter param: number 8, offset 0.000112, delay 0.001176, dispersion 0.005179, jitter 0.000182, burst 0

*Jun 25 14:20:23:073 2022 Server NTP/7/SELECT: endpoint -1, -0.017312

*Jun 25 14:20:23:073 2022 Server NTP/7/SELECT: endpoint  0, 0.000112

*Jun 25 14:20:23:073 2022 Server NTP/7/SELECT: endpoint  1, 0.017535

*Jun 25 14:20:23:073 2022 Server NTP/7/SELECT: peer 192.168.3.2, offset 0.000112, low -0.017312, high 0.017535, flags 00000401

*Jun 25 14:20:23:073 2022 Server NTP/7/SELECT: Survivor 192.168.3.2, distance 8.002459

*Jun 25 14:20:23:073 2022 Server NTP/7/SELECT: Combine offset 0.000111693, jitter 0.000182289

*Jun 25 14:20:23:073 2022 Server NTP/7/SYNCH: Synchronized to peer 192.168.3.2

*Jun 25 14:20:23:073 2022 Server NTP/7/SELECT: Clock update at 102263, sample 101788, session ID 23881, offset 0.000112

*Jun 25 14:20:23:073 2022 Server NTP/7/ADJUST: Reset clock state, time count difference 68, state 5->5, poll 6, count 0, offset  0.000

*Jun 25 14:20:23:073 2022 Server NTP/7/ADJUST: Adjust local clock: offset 0.000111693 jitter 0.000221751 freq -0.385 stab 0.000 poll 6

找研发确认过debug 回显参数的含义，

这条debug信息用以显示当前报文处理结果 : 权限类型

(与ntp-service peer/server/synchronization/query   acl命令对应):

从以上信息看，思科发来的NTP消息被拒绝。经确认设备处理逻辑如下：

1、 中间设备既配置peer又配置server，那先匹配peer，如果没有命中peer，那就跳出匹配不再继续往下匹配。

2、 设备上只要配置了server，那它就不能从别的设备拿时间，只能提供时间。

中间设备全部配置peer acl