Interpret

3.3.a Interpret network time protocol configurations such as NTP and PTP

4 min read ENCOR 350-401 v1.2

Aligned to Cisco's 350-401 ENCOR v1.2 exam topics.

On this page

Time is infrastructure. If network devices disagree about time, logs become harder to trust, certificates can fail, automation gets messy, and event correlation becomes guesswork.

ENCOR expects you to interpret common time configuration, especially NTP and PTP.

NTP hierarchy (stratum increases away from reference):
  Stratum 0 GPS / atomic reference (not on network as NTP server)
  Stratum 1 enterprise NTP server
  Stratum 2 distribution / core routers

NTP in one sentence

Network Time Protocol synchronizes clocks by letting devices learn time from trusted time sources, then choose the best source based on stratum, reachability, delay, and stability.

A simple client configuration:

clock timezone UTC 0 0
ntp server 192.0.2.10 prefer
ntp server 192.0.2.11
ntp source Loopback0

Verify:

show ntp status
show ntp associations
show ntp associations detail
show clock detail

NTP stratum

Stratum describes distance from an authoritative time source.

Stratum 0: reference clocks such as GPS or atomic clocks.
Stratum 1: directly connected to a reference clock.
Stratum 2: synced to stratum 1.
Higher numbers: farther away.

Lower is usually better, but stratum alone is not everything. Reachability and stability matter too.

Reading `show ntp associations`

Example shape:

address ref clock st when poll reach delay offset disp
*~192.0.2.10 .GPS. 1 34 64 377 1.23 -0.42 0.92
+~192.0.2.11 192.0.2.10 2 31 64 377 2.10 0.81 1.22

Common symbols:

Symbol	Meaning
`*`	Current selected time source.
`+`	Candidate source. Good but not selected.
`-`	Discarded by selection algorithm.
`~`	Server association.

reach 377 is good. It is an octal value showing successful recent polls. If reach is 0, the device is not hearing replies.

NTP authentication

Authenticated NTP helps prevent accepting time from an untrusted source.

ntp authentication-key 10 md5 7 030752180500
ntp authenticate
ntp trusted-key 10
ntp server 192.0.2.10 key 10 prefer

In old IOS examples, the 7 in md5 7 ... is Cisco type 7 storage for the configured key string. Treat type 7 as weak obfuscation, not strong cryptographic protection. For ENCOR, the point is to interpret whether NTP authentication is enabled, whether the server is referenced with the expected key, and whether a key mismatch can prevent synchronization.

Verify:

show ntp associations detail
show run | include ntp

If authentication keys do not match, the association may be present but not synchronize.

NTP access control

NTP can be restricted with ACLs:

ip access-list standard NTP-SERVERS
 permit 192.0.2.10
 permit 192.0.2.11
!
ntp access-group peer NTP-SERVERS

Be careful. A wrong ACL can block your only time source.

PTP in one sentence

Precision Time Protocol provides much tighter time synchronization than NTP, often used where sub-millisecond or microsecond-level timing matters.

PTP is common in environments that need precise event ordering or timing, such as industrial, financial, media, or certain wireless/transport networks.

PTP roles

Role	Meaning
Grandmaster	Best clock source for the PTP domain.
Ordinary clock	One PTP port; can be master or slave.
Boundary clock	Multiple PTP ports; participates in timing and segments the domain.
Transparent clock	Does not become master/slave; corrects timing messages for residence time.

PTP uses the Best Master Clock Algorithm to choose the grandmaster.

PTP interpretation

PTP configuration varies by platform, but expect to recognize ideas like:

ptp mode boundary
ptp domain 10
!
interface GigabitEthernet1/0/1
 ptp enable

Verify with platform-appropriate commands, often similar to:

show ptp clock
show ptp parent
show ptp port
show ptp brief

Look for:

Clock state.
Grandmaster identity.
Domain number.
Port state.
Offset from master.

NTP vs PTP

Topic	NTP	PTP
Precision	Good enough for most network logging	Much higher precision
Complexity	Lower	Higher
Common use	Routers, switches, servers, logs	Timing-sensitive networks
Network support	Works over normal IP networks	Benefits from PTP-aware devices

Lab: Interpret NTP health

Task 1: Configure two NTP servers

clock timezone UTC 0 0
ntp source Loopback0
ntp server 192.0.2.10 prefer
ntp server 192.0.2.11

Task 2: Verify selected source

show ntp status
show ntp associations

Answer:

Is the clock synchronized?
Which server is selected?
What is the stratum?
Is reachability healthy?

Task 3: Break reachability

Apply an ACL blocking NTP to one server, or remove the route. Then check:

show ntp associations
show ip route 192.0.2.10
show access-lists

Task 4: Fix it

Restore reachability and watch reach increase over time.

Exam traps

NTP can be configured but not synchronized.
show clock alone does not prove NTP sync.
reach 0 points to communication failure.
Authentication mismatch can prevent synchronization.
PTP is not just “better NTP.” It is a different protocol for higher-precision timing.
PTP domain mismatch can make clocks ignore each other.

Quick checklist

Is the clock synchronized?
Which source is selected?
Is reachability nonzero and healthy?
Are source interface, routing, ACLs, and authentication correct?
For PTP, is the domain correct and is a grandmaster selected?
Does the device role match the design: ordinary, boundary, or transparent?