Using windows 2003 as a NTP server to Cisco and HP devices

[Hugo Tigre]

According to Microsoft, windows 2000 used SNTP and 2003 uses NTP, however, if I try to config my networking equipment (like a cisco router) to use 2003 as a NTP server, this doesn't work...

All the information I found about this, tells me that Cisco NTP and Microsoft NTP are not compatible, but this shouldn't be, they are supposed to be based on the same RFC (I don't trust Microsoft by the way), and I didn't found any information either on Cisco or Microsoft about this.

But, if i configure the network devices as SNTP clients and using windows 2003 as NTP server, it works, but it should work with NTP. This is a problem for me, since i have a lot of devices that only come with NTP.

This happens with HP switches also.

Does anyone have any idea how to fix this???

PS: i know there is some ntp software that you can install on windows 2003 and fixes this issue, but it also disables windows time server, and this is a problem for windows xp clients, and so, it's not an option for me.

thanks in advance,
hugo

[Matt Hobbs]

That is strange... the ProCurve switches I know all only support SNTP or TimeP. None of them support NTP. (Maybe the 9300 and 7000dl series do?)

Using SNTP I'm currently syncing up with a 2003 NTP server no problem as you've already suggested.

[Hugo Tigre]

That is strange... the ProCurve switches I know all only support SNTP or TimeP. None of them support NTP. (Maybe the 9300 and 7000dl series do?)

Using SNTP I'm currently syncing up with a 2003 NTP server no problem as you've already suggested.

I may have explained something the wrong way. I didn't said that procurve switches used NTP, has far as i know and on my switches i use SNTP only.

But I have a lot of cisco devices that only use NTP, and the ones that can use SNTP, i can get it to work with windows 2003 Time Server.

The problem is, that since windows 2003 uses NTP (windows 2000 used SNTP), it should work with other NTP compiled devices.

[Mark Danner]

Are you setup for broadcast or unicast? i.e. on my 2626s, in the setup menu, SNTP mode is set to Unicast (the other two options are Broadcast and Disabled).

Mark

[Hugo Tigre]

That's not the point.

i can config hp and cisco clients to user windows 2003 as a time server if i configure them as SNTP clients.

The problem is with clients that only support NTP.

[Matt Hobbs]

I tried this with a Cisco 2600 syncing to my 2003 Server and it worked fine!

On my router I set:
ntp server
clock timezone Melbourne 11

And it worked immediately.

It was a fair while ago that I configured my 2003 server for NTP, but I believe I followed this:

http://support.microsoft.com/kb/216734

Under the section:
"Configuring Windows Time service to use an external time source"

[Ashly A K]

hi!

I have seen this issue, and it was related to the IOS!!!

Well, there is a tool called Tradis, which is a good NTP and i have seen it working with more than 1000 routers+servers+desktops without any issue.

Regards,
-Ashly

Ps: Thanks for the points, if any.

[Hugo Tigre]

Matt:

The config you suggested doesn't work with windows as a time source. you said you have configured you windows server to use a external time source and in that case i don't know if it works, but in my case i don't wont to use a external time source.

Ashly:

That i can't tell... I've tried in a 1711 and on a 3600 and none of them works, the 1711, however, works with SNTP.

I sniffed the NTP traffic between the server and the client with wireshark.
I attached the log file here (you will probably be able to read this file better if you have wireshark).

I didn't detect anything that should be responsible for the incompatibility between the microsoft NTP server and the Cisco NTP client. But there are some very different values in the clock precision and dispersion, but i don't really know if that matters. Also you can see that in the time exchange values, it doesn't quite makes sense.

if anyone could look at the file, maybe you can read it better than i can.

PS: wireshark is the new Ethereal for those you don't know.

[Matt Hobbs]

My guess is that the NTPServer is not enabled by default on 2003 Server. If the server does not believe it is a reliable time server it will not provide NTP time to clients.

My untested theory is that you must configure the time service to either use the internal source or an external source.

http://support.microsoft.com/kb/816042/

From memory I couldn't get even my SNTP clients to sync to my 2000 server until I made a registry change.

Anyway I might run some more tests tomorrow on an untouched server if I get some time.

[Hugo Tigre]

I will try to look a little deeper in the ntp options in windows 2003.

I've just confirmed that on some IOS versions sntp works, and on others it doesn't. This is true no matter what version of sntp we use (1, 2 or 3).

It's frustrating not knowing why this is happening :S and i don't really have a lot of time to give on this matter.

Matt:

Windows 2003 is supposed to be, by default, a NTP server witch gives the correct time to clients [ntp or sntp] that ask for it. I think, but not sure, inside it's network it's considered to be a stratum 1 server.

So if i wanted to change this, i had to config windows 2003 to use a external stratum 2 sever, but like i said, i don't want to do this on my network.

regards,
hugo

[Matt Hobbs · Accepted solution]

I tried again today with a 2003 server that was only part of a workgroup. Initially it would not respond to any NTP requests, so I went into the registry and in the key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer

I changed Enabled from 0 to 1.

It would now respond but the Cisco 2600 would not accept the time - I initially though it was because it was given either due to it being an unspecified stratum, or it having a null reference clock ID.

I went to apply the "Configuring the Windows Time service to use an internal hardware clock" but it looks to be that way by default on non-domain controllers.

Finally I applied the external time clock method, this still didn't work! Closer inspection in the packet capture revealed the only difference being the 'clock dispersion' was 16 seconds. My other one was under a second. I can see on your traces that it was around 10 seconds.

Next I simply rebooted this server, it still didn't work immediately as it hadn't synced to the external time source. Once it synced though, it's 'clock dispersion' was now under a second and then the sync to the Cisco worked fine.

My theory now is that some devices required the 'clock dispersion' to be under 1 second.

[Matt Hobbs]

Since yours was at 10 seconds, try changing it to 1 maybe:

http://technet2.microsoft.com/WindowsServer/en/library/a9fb3bdd-766e-4137-9321-d9dc14a08b0d1033.mspx?mfr=true

[Ashly A K]

mm...i too did little reading for you, please see the below stuffs :

Windows 2000 uses SNTP while Windows 2003 use NTP. I belive, Cisco Devices above 1600 routers all use NTP and a NTP client cannot sync to a SNTP Server

See the below link :
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/ws03mngd/26_s3wts.mspx
http://www.tek-tips.com/viewthread.cfm?qid=1310139&page=4

-Ashly

[Hugo Tigre]

Matt:

right on the money.. :)

I changed LocalClockDispersion to 0, and it finally worked with NTP.

Now i just need to check if this has any implication to windows xp clients and current sntp client devices. And i need to test this with different IOS versions.

But finally a breakthrough :)

I attached the new sniffed packets if anyone wants to see the clock dispersion value.

i will post any new developments in this matter.

best regards,
hugo

[Hugo Tigre]

ups... forgot to attach the file