NTP
The DD Engine system has the ability to update system time automatically using NTP (Network Time Protocol). NTP can be utilized in the following ways:
- Import time to the Upstream section
- Import time to the Downstream section
- Forward time from the Upstream section to the Downstream section
- Export time to external NTP clients
It is not possible to configure NTP import and export on the same network simultaneously. It is, however, possible to import from one network and then export on the other network.
Configuration
NTP is configured in the Features section of the Configuration, using DD Manager on both the Upstream and Downstream sections, as described in Manage configurations.
Parameters
The following parameters are configurable:
| Parameter | Description | Format |
|---|---|---|
| Import time | Available on both Upstream and Downstream. | |
| Source | Select what network to import time from, Admin or Data. If None is selected, NTP will not be used and the section of the device will rely on manually configured time, see Date and time. Selecting Upstream proxy in the Downstream configuration will allow the Downstream section to receive time sent by the Upstream section, see Time forwarding. | Available options: None, Admin network, Data network and Upstream proxy (Downstream only) |
| NTP Server-1 | Only displayed when NTP is activated. Additional NTP servers can be added by clicking the + button further down in the configuration. Up to 10 NTP servers can be configured. | |
| Port | UDP port number used when importing time. | Integer within range 1 - 65535. Default: 123 |
| Address | IP address or hostname of the remote NTP server used when importing time. Note! Hostname can only be used if Source is set to Admin network and an Admin DNS server is configured in Local admin. | String |
| Authentication | Authentication method to be used. None will use the standard NTP protocol, without authentication, when communicating with the remote NTP server. NTS will use the NTS (Network Time Security) protocol for authentication. TLS is used to exchange a key with the remote NTP server, which is then used to encrypt the NTP traffic. | Available options: None and NTS |
| NTS port | Displayed when Authentication is set to NTS. TCP port to connect to when initially performing the key exchange. | Integer within range 1 - 65535. Default: 4460 |
| CA certificate | Displayed when Authentication is set to NTS. A CA certificate in PEM file format that will be used to verify the server during the key exchange must be supplied and uploaded using the file upload dialogue. | PEM file name |
| Maximum offset | If imported time differs more than the configured maximum offset from the current time of the DD Engine, the time will be considered invalid, and the device time will not be updated. If a maximum offset is not configured (default value=0), any imported time is accepted. | Seconds Default: 0 |
| Step threshold | The threshold in seconds. If the imported time is off by a value greater than the step threshold, the local clock will be immediately adjusted to the correct time. If the imported time is off by a value less than the step threshold, the local clock will be adjusted gradually over a longer period. | Integer within range 1 - 4294967295 Default: 1 |
| Time forwarding | Only available on Upstream. | |
| State | When enabled, the current Upstream time will continually be sent to the Downstream section. See Time forwarding for further information. | Available options: Enabled and Disabled |
| Export time | Only available on Downstream. | |
| Destination | Select what network to export time to, Admin or Data. Note! External NTP clients will only be able to communicate with the NTP server using the configured network interface. All incoming NTP packets to another network interface will be immediately dropped. If None is selected, NTP will not be used for exporting time to Downstream clients. Note! The parameters listed below will not be made available in the configuration. | Available options: None, Admin network and Data network |
| Port | UDP port to use when communicating with remote NTP clients. | Integer within range 1 - 65535. Default: 123 |
| Authentication | Authentication method to be used by remote NTP clients. None will use the standard NTP protocol, without authentication. NTS will use the NTS (Network Time Security) protocol for authentication. TLS is used to exchange a key with the remote NTP clients, which is then used to encrypt parts of each NTP packet. The actual time synchronization data is not encrypted, but activating NTS will ensure that time information comes from a verified and trusted source. | Available options: None and NTS |
| Default stratum | The stratum to use when importing time from the upstream proxy, or when no time sources are configured. If time is imported from the Admin or Data networks, the device derives its stratum from the configured servers. | Integer within range 1 - 15. Default: 10 |
| NTS port | TCP port to be used for initial NTS key exchange (NTS-KE). Only available when Authentication is set to NTS. | Integer within range 1 - 65535. Default: 4460 |
| Server certificate | The server certificate, in PEM format, that will be used to validate the TLS connection during initial NTS key exchange (NTS-KE). Only available when Authentication is set to NTS. | A file containing a PEM format X.509 certificate. |
| Server key | The server certificate's private key, in PEM format, that will be used to validate the TLS connection during initial NTS key exchange (NTS-KE). Only available when Authentication is set to NTS. | A file containing a PEM format X.509 private key. |
When more than one NTP server is configured and the system is trying to select the most accurate of the configured NTP servers, authentication method is not considered, i.e. all NTP servers are considered equally trustworthy, regardless of whether they use NTS, or not.
Time forwarding
When Time forwarding is enabled for the Upstream section, the current Upstream time will continually be forwarded to the Downstream section. If the Downstream section is configured to import time from Upstream (see the Source parameter in Parameters), it will receive the forwarded time and synchronize its clock.
Importing of time does not need to be enabled on the Upstream section to forward time to the Downstream section. If the Upstream Source parameter is set to None and the Time forwarding State parameter is set to Enabled, while the Downstream Source parameter is set to Upstream proxy, the manually set Upstream time will be forwarded. This will keep the Upstream and Downstream clocks synchronized, even if NTP is not activated.
Activating Time forwarding introduces a less than 1 ms delay in the time received on the Downstream section, making Time forwarding unsuitable where extremely high accuracy is required.
Local time and NTP
Time can always be set manually using Local Admin on both Upstream and Downstream sections. However, if time is synchronized using NTP in any way, the NTP functionality will attempt to change the time back to the correct value. If the Maximum offset parameter is configured and the difference between the imported time and the manually set time is greater than the offset, the attempt to change the time will fail, leaving the device time at the manually set value.