Skip to content
Study CCNP

Interpret

3.3.a Interpret network time protocol configurations such as NTP and PTP

4 min read ENCOR 350-401 v1.2 Updated

Aligned to Cisco's 350-401 ENCOR v1.2 exam topics.

On this page

What this objective tests

The objective says "interpret". The exam shows you a config or show output. You must state whether the clock is synchronized and why.

Time is infrastructure. If devices disagree about time, logs become hard to trust. Certificates can fail. Event correlation becomes guesswork.

Two protocols matter: Network Time Protocol (NTP) for general network time, and Precision Time Protocol (PTP) for high-precision timing.

NTP stratum and roles

Stratum is the distance from an authoritative clock:

Stratum 0: GPS or atomic reference clock (not an NTP server itself)
Stratum 1: server connected to a reference clock
Stratum 2: server synced to a stratum 1 server
Stratum 3+: clients and downstream servers

Lower stratum is closer to the reference. A device can be a client to an upstream server and a server to downstream devices at the same time.

Example: NTP server and client

R1 learns time from an upstream stratum 1 server. R1 also serves the campus. ntp master 4 lets R1 keep serving time at stratum 4 if the upstream source fails.

R1:

clock timezone UTC 0 0
ntp server 192.0.2.10 prefer
ntp source Loopback0
ntp master 4

SW1 (client):

clock timezone UTC 0 0
ntp server 10.255.255.1 prefer
ntp source Vlan10

Note: prefer makes that server the first choice when several servers are healthy.

Reading show ntp associations

SW1# show ntp associations

  address         ref clock       st   when   poll reach  delay  offset   disp
*~10.255.255.1    192.0.2.10       2     34     64   377  1.23   -0.42   0.92
 ~10.255.255.2    .INIT.          16      -     64     0  0.00    0.00  15937.

 * sys.peer, # selected, + candidate, - outlyer, x falseticker, ~ configured

Read this output:

FieldMeaning
*The selected time source. The device syncs to this server.
+A candidate. Good, but not selected.
-Discarded by the selection algorithm.
~A configured server association.
ref clockThe clock the server itself uses. .INIT. means not synchronized.
stStratum of the server. 16 means unsynchronized.
reachOctal history of the last eight polls. 377 means all replies arrived. 0 means no replies.

The first server is healthy: selected, stratum 2, reach 377. The second server is dead: stratum 16 and reach 0.

Note: show clock alone does not prove NTP sync. Check show ntp status for "Clock is synchronized" and read the associations.

NTP authentication

Authentication stops the device from accepting time from a wrong source:

ntp authentication-key 10 md5 7 030752180500
ntp authenticate
ntp trusted-key 10
ntp server 10.255.255.1 key 10

If the keys do not match, the association appears but never synchronizes. Check with show ntp associations detail.

PTP clock roles and profiles

PTP gives much tighter synchronization than NTP. Use it where sub-millisecond timing matters: industrial networks, finance, media, and some transport networks.

Clock roles:

RoleMeaning
GrandmasterThe best clock and the time source for the PTP domain
Ordinary clockOne PTP port. Master or slave.
Boundary clockMany PTP ports. Slave to the upstream, master to the downstream. Segments the domain.
Transparent clockNot a master or slave. Corrects PTP messages for the time spent inside the device.

The Best Master Clock Algorithm chooses the grandmaster.

Profiles:

ProfileUseTransport
Default (IEEE 1588)General enterprise timingUDP over IPv4 or Layer 2
Telecom (G.8275.1)Telecom phase and time syncLayer 2 multicast
Telecom (G.8275.2)Telecom sync over routed IPUnicast UDP
Power (IEEE C37.238)Power utility substationsLayer 2

A boundary clock example:

ptp mode boundary
ptp domain 10
!
interface GigabitEthernet1/0/1
 ptp enable

Verify with platform commands such as show ptp clock, show ptp parent, and show ptp port. Look for the clock state, the grandmaster identity, the domain number, and the offset from the master.

Lab: interpret NTP health

Topology: SW1 uses R1 (10.255.255.1) as its NTP server.

Do these steps:

  1. Configure R1 as the time source with the server config above.
  2. Configure SW1 as the client with the client config above.
  3. Verify on SW1 with show ntp status and show ntp associations. Confirm the * and reach 377.
  4. Break reachability: remove the route to 10.255.255.1 on SW1.
  5. Check show ntp associations again. Watch reach fall to 0 over time.
  6. Restore the route. Confirm reach returns to 377.

Exam traps

  • NTP can be configured and still not synchronized. Read the associations, not the config.
  • reach 0 means no replies. Check routing and ACLs.
  • Stratum 16 means the server is unsynchronized.
  • An authentication key mismatch prevents sync without a clear error.
  • PTP is a different protocol, not a faster NTP. A domain mismatch makes clocks ignore each other.

Pass check

You are ready when you can do these things:

  • Read show ntp associations and name the selected source, stratum, and health.
  • Configure an NTP server and an NTP client.
  • Name the four PTP clock roles and give one use for each profile.
  • Explain why stratum 16 or reach 0 means trouble.

Related objectives