104
Usage guidelines
You can control IPv6 NTP access by using ACL. The access rights are in the following order, from
least restrictive to most restrictive:
peer
,
server
,
synchronization
, and
query
.
The device processes an NTP request by following these rules:
•
If no NTP access control is configured,
peer
is granted to the local device and peer devices.
•
If the IP address of the peer device matches a
permit
statement in an ACL for more than one
access right, the least restrictive access right is granted to the peer device. If a
deny
statement
or no ACL is matched, no access right is granted.
•
If no ACL is created for an access right, the associated access right is not granted.
•
If no ACL is created for any access right,
peer
is granted.
The
ntp-service ipv6 acl
command provides a minimum security method. NTP authentication is
more secure.
Examples
# Configure the peer devices on subnet 2001::1 to have full access to the local device.
<Sysname> system-view
[Sysname] acl ipv6 number 2001
[Sysname-acl6-basic-2001] rule permit source 2001::1 64
[Sysname-acl6-basic-2001] quit
[Sysname] ntp-service ipv6 peer acl 2001
Related commands
ntp-service authentication enable
ntp-service authentication-keyid
ntp-service reliable authentication-keyid
ntp-service ipv6 dscp
Use
ntp-server ipv6 dscp
to configure a DSCP value for IPv6 NTP packets.
Use
undo ntp-server ipv6 dscp
to restore the default.
Syntax
ntp-service ipv6 dscp
dscp-value
undo ntp-service ipv6 dscp
Default
The DSCP value for IPv6 NTP packets is 56.
Views
System view
Predefined user roles
network-admin
mdc-admin
Parameters
dscp-value
: Specifies a DSCP value in the range of 0 to 63 for IPv6 NTP packets.
Usage guidelines
The DSCP value is included in the Traffic Class field of an IPv6 packet to identify the packet priority.