Network Time Protocol (NTP)

Network devices, like your home devices, need to share the same time across the network.
Routers and switches have internal clocks, but those clocks can drift. After days or weeks, different devices might show different times.

Figure 1 – Time out of sync before Network Time Protocol

Network Time Protocol (NTP) keeps all devices in sync with a common, accurate time source. With NTP in place, the whole network stays aligned.

Figure 2 – Time synchronized with Network Time Protocol

The IETF standardized NTP in RFC 5905, with NTPv4 being the current version. It's widely used in enterprise networks to keep devices synchronized in time.

Why do we need synchronized time?

• Log correlation (Syslog): Sync device timestamps. This helps accurately link events during troubleshooting or security issues.
  

• Security & certificates: Many mechanisms rely on accurate time. For example, certificate validity and time-sensitive handshakes in IPsec/TLS depend on it.
  

• Time-based policies & jobs:

  • Enforce time-based ACLs.

  • Run backups, scripts, and automations at the right times.

  • Meet auditing and compliance needs.

In short, synchronized clocks make the network easier to troubleshoot, more secure, and more reliable.

NTP uses a simple Client–Server Model. In this model, an NTP Server is connected to a reliable time source and periodically sends timestamps to its clients. These timestamps are numeric values that represent the current time.

When the clients receive the information, they compare it with their own local clock and then adjust their time in small steps.

All exchanges are lightweight, and they use UDP port 123 for communication.

Reference Clock

An NTP Server doesn't invent the time. It relies on a reference clock, a highly accurate source such as a GPS receiver tied to atomic clocks, or a ground-based atomic/radio clock.

Figure 3 – Authoritative time source using onboard atomic clock

Traditionally, GPS satellites carry atomic clocks that provide extremely precise time. A ground antenna/dish receives the time signal, the NTP Server ingests those timestamps, and then distributes them to the rest of the network.

NTP Stratums

When using Network Time Protocol, remember that NTP networks are arranged in levels called stratums (from the Latin word for layer).

In NTP, a device's stratum indicates how far it is from the most accurate time source, the reference clock.

In the case below, Stratum 0 is the GPS system acting as the reference clock.

Figure 4 – Network Time Protocol stratum hierarchy

As you go down the layers, the stratum number increases. Usable levels are 1 to 15; Stratum 16 means the device is unsynchronized.

In a typical NTP network, a Stratum 1 Server is directly connected to the reference clock.

Figure 5 – NTP Client-Server Communication by Stratum

Then a Stratum 2 device synchronizes to Stratum 1 (client role) and can serve time to lower levels. A Stratum 3 device is usually client-only, learning time from Stratum 2.

It's a hierarchy: as the stratum increases, accuracy decreases slightly due to added delay. Clients therefore prefer the lowest-stratum reachable server.

In some networks, there is no external NTP Server available.
To keep timestamps consistent across the network, one device must provide time to all others.

Figure 6 – NTP Master and Server configuration

The ntp master command allows a router to act as an NTP Server based on its local hardware clock, with a configurable stratum level. This is typically used when a network needs its own internal time source.

How NTP Master Works

When ntp master is enabled, the router uses its internal clock as the reference and distributes time to downstream devices such as switches or other routers.

Figure 7 – NTP Server failover scenario

In this example, R1 provides time to SW1, ensuring the switch stays synchronized even without an external NTP source.