On 8/12/06, Philip Prindeville <<a href="mailto:philipp_subx@redfish-solutions.com">philipp_subx@redfish-solutions.com</a>> wrote:<div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> Ok, well, so I can be sure that it's the broken build and not my config, what should the config look like ideally? -Philip</blockquote><div> If the router that is offering multicast NTP time service has an IP of <a href="http://10.1.2.3">10.1.2.3</a> this would be the minimum config for a client. You may have to define the source interface for NTP on a Cisco router: multicastclient restrict default ignore restrict <a href="http://224.0.1.1">224.0.1.1</a> restrict <a href="http://10.1.2.3">10.1.2.3</a> server <a href="http://127.127.1.0">127.127.1.0</a> # local clock (LCL) fudge <a href="http://127.127.1.0">127.127.1.0 </a> stratum 10 # LCL is unsynchdronized driftfile /etc/ntp/drift I think it is easier to debug this by commenting out all "restrict" lines and seeing if it works. If it does, your problems are with the ACL's. If it does not work the problem is elsewhere. The lines for "server <a href="http://127.127.1.0">127.127.1.0</a>" and "fudge <a href="http://127.127.1.0">127.127.1.0</a> stratum 10" allow NTP to take its time from localhost, if outside sources cannot be queried. /etc/ntp/ needs to be writable by user ntp. In RH's ntpd, ntpd drops to user ntp after it starts. I find this file is often owned by root in RH, so you will never get a drift file written and long term time keeping will not be that good. NTPd requites 4 separate sources for time so its "false ticker" algorithms will operate, allowing one source to go bad. 3 sources are required to offer long term accurate time. james </div> </div>