Wrong time on a network device is not a cosmetic problem. Certificate validation fails, log timestamps become useless for incident correlation, and time-based authentication (like 802.1X with certificates, or API tokens) starts breaking in ways that look random. NTP fixes all of that with two lines of configuration, and this article shows a real Cisco IOS XE deployment: one router acting as the time source, the others syncing to it, with genuine show output at every stage of convergence. It is part of the IP Services complete guide.
Stratum: How Far You Are From the Truth
NTP organizes time sources in a hierarchy called stratum. Stratum 1 servers own a reference clock directly (GPS, atomic). A device syncing to stratum 1 becomes stratum 2, a device syncing to that becomes stratum 3, and so on down to stratum 15. Stratum 16 has a special meaning: unsynchronized, no valid time source. It is not "level 16," it is "off the ladder entirely," and you will see it in real output below.
Lower stratum means closer to the reference, not necessarily better quality, but as a rule you point your network at two or three consistent sources and let the hierarchy fan out from there.
The Lab Design: One Master, Everyone Else a Client
The standard enterprise pattern is exactly what this lab runs: a core device gets authoritative time (in production, from pool.ntp.org or an internal GPS appliance; in the lab, from its own calendar via ntp master), and everything else syncs to it internally.
! R1 - the internal time source
R1(config)#ntp master 3
! R2, R3 - clients
R2(config)#ntp server 1.1.1.1ntp master 3 makes R1 serve its local clock as if it were a stratum 3 source. Why 3 and not 1? Convention and humility: if R1 ever gets a real upstream source, genuine stratum 1 and 2 servers should win the comparison. R1 confirms it is serving time:
R1#show ntp status | include Clock|stratum
Clock is synchronized, stratum 3, reference is 127.127.1.1That reference address 127.127.1.1 is not a routable host: it is NTP's internal notation for "my own local clock" (the 127.127.x.x block identifies driver types, and .1 is the local clock driver).
Watching a Client Converge (the Part Nobody Shows You)
Most tutorials show the final synced state and skip the several minutes in between, which is exactly when people panic and start deleting configuration. Here is R2 immediately after ntp server 1.1.1.1 was configured:
R2#show ntp associations
address ref clock st when poll reach delay offset disp
~1.1.1.1 .TIME. 16 59 64 0 0.000 0.000 15937.
* sys.peer, # selected, + candidate, - outlyer, x falseticker, ~ configured
R2#show ntp status
Clock is unsynchronized, stratum 16, no reference clock
reference time is 00000000.00000000 (00:00:00.000 UTC Mon Jan 1 1900)Stratum 16, reach 0, reference time in the year 1900. Nothing is broken; NTP just has not exchanged enough polls yet. The column that tells the real story is reach. It is an 8-bit shift register displayed in octal: every poll cycle (64 seconds here, per the poll column) shifts in a 1 for a successful exchange. A few cycles later:
R2#show ntp associations
address ref clock st when poll reach delay offset disp
*~1.1.1.1 127.127.1.1 3 14 64 17 2.000 0.000 3.017Reach 17 (octal) means the last four polls all succeeded. The * in front of the address is the important promotion: this peer is now the sys.peer, the chosen synchronization source. And after the register fills completely:
R2#show ntp associations
address ref clock st when poll reach delay offset disp
*~1.1.1.1 127.127.1.1 3 65 64 377 3.000 -0.500 3.334
R2#show clock detail
*23:05:33.109 UTC Fri Jul 10 2026
Time source is NTPReach 377 is the healthy steady state: all eight of the last eight polls answered. Delay is 3 ms, offset half a millisecond. show clock detail confirms the clock is being driven by NTP. One honest platform note: on this virtual lab router the show ntp status header was slow to flip from "unsynchronized" even with reach at 377 and a selected sys.peer, so judge synchronization by the associations line and show clock detail, not by the status header alone (on hardware the header catches up within a few poll cycles).
ntp server vs ntp master
ntp server <address> makes the router a client of that address (and, automatically, a server to anyone downstream once it syncs). ntp master [stratum] makes the router serve its own local clock as authoritative even with no upstream source. Use ntp master only on the designated internal source (or in labs); if several routers all claim mastership, your network happily synchronizes to multiple disagreeing "truths." In production the core device typically has both: ntp server lines pointing at external sources, and its role as internal server flows from that without any ntp master at all.
Production Polish: Source Interface and the Calendar
Two small settings separate lab NTP from production NTP. First, source your NTP traffic from a loopback so your time infrastructure does not depend on any single physical link, and so server-side access lists see one stable address per device:
ntp source Loopback0Second, on platforms with a battery-backed hardware calendar, ntp update-calendar writes the disciplined NTP time back to the hardware clock periodically. That way a reload starts from approximately correct time instead of a factory default, which matters because NTP itself refuses to correct offsets larger than about 1000 seconds (it assumes something is badly wrong and waits for a human). A router that boots thinking it is the year 2002 will sit unsynchronized forever until someone sets the clock manually with clock set and lets NTP take over from there.
Hardening: Authentication Exists, Use It
NTP will happily accept time from anyone you point it at, and skewing a device's clock is a real attack (expired certificates suddenly validate, log timelines get scrambled). IOS XE supports MD5/SHA authentication of NTP associations:
ntp authenticate
ntp authentication-key 1 sha1 <key-string>
ntp trusted-key 1
ntp server 1.1.1.1 key 1Configure the same key on the server side and the association only forms when the keys match. Also consider ntp access-group to control which devices may sync from you at all.
Key Takeaways
NTP is two commands (ntp master on the source, ntp server on clients) and one discipline: knowing how to verify it. Stratum measures distance from the reference clock, with 16 meaning "not synchronized at all." Convergence takes minutes, not seconds; read the reach octal register and look for the * sys.peer marker instead of restarting things. Reach 377 plus Time source is NTP in show clock detail is your healthy state. Authenticate NTP in production, because everything from certificates to your syslog timeline (see the syslog deep dive) depends on this one service being right. The rest of the services stack lives in the IP Services complete guide.
