df2a4ded98
Added source interface support for NTP. Also made NTP start on Mgmt-VRF by default when configured. **- How I did it** 1) Updated hostcfg to listen to global config NTP and NTP_SERVER tables and restart ntp when ever the configuration changes. NTP table includes source interface configuration. 2) The ntp script updated to by default start on Mgmt-VFT when configured. Signed-off-by: Prabhu Sreenivasan <prabhu.sreenivasan@broadcom>
120 lines
4.5 KiB
Django/Jinja
120 lines
4.5 KiB
Django/Jinja
###############################################################################
|
|
# Managed by Ansible
|
|
# file: ansible/roles/acs/templates/ntp.conf.j2
|
|
###############################################################################
|
|
|
|
# /etc/ntp.conf, configuration for ntpd; see ntp.conf(5) for help
|
|
|
|
# To avoid ntpd from panic and exit if the drift between new time and
|
|
# current system time is large.
|
|
tinker panic 0
|
|
|
|
driftfile /var/lib/ntp/ntp.drift
|
|
|
|
|
|
# Enable this if you want statistics to be logged.
|
|
#statsdir /var/log/ntpstats/
|
|
|
|
statistics loopstats peerstats clockstats
|
|
filegen loopstats file loopstats type day enable
|
|
filegen peerstats file peerstats type day enable
|
|
filegen clockstats file clockstats type day enable
|
|
|
|
|
|
# You do need to talk to an NTP server or two (or three).
|
|
#server ntp.your-provider.example
|
|
|
|
# pool.ntp.org maps to about 1000 low-stratum NTP servers. Your server will
|
|
# pick a different set every time it starts up. Please consider joining the
|
|
# pool: <http://www.pool.ntp.org/join.html>
|
|
{% for ntp_server in NTP_SERVER %}
|
|
server {{ ntp_server }} iburst
|
|
{% endfor %}
|
|
|
|
#listen on source interface if configured, else
|
|
#only listen on MGMT_INTERFACE, LOOPBACK_INTERFACE ip when MGMT_INTERFACE is not defined, or eth0
|
|
# if we don't have both of them (default is to listen on all ip addresses)
|
|
interface ignore wildcard
|
|
|
|
# set global variable for configured source interface name
|
|
# set global boolean to indicate if the ip of the configured source interface is configured
|
|
# if the source interface is configured but no ip on that interface, then listen on another
|
|
# interface based on existing logic
|
|
{%- macro check_ip_on_interface(interface_name, table_name) %}
|
|
{%- if table_name %}
|
|
{%- for (name, source_prefix) in table_name|pfx_filter %}
|
|
{%- if source_prefix and name == interface_name %}
|
|
true
|
|
{%- endif %}
|
|
{%- endfor %}
|
|
{%- endif %}
|
|
{%- endmacro %}
|
|
|
|
{% set ns = namespace(source_intf = "") %}
|
|
{% set ns = namespace(source_intf_ip = 'false') %}
|
|
{% if (NTP) and (NTP['global']['src_intf']) %}
|
|
{% set ns.source_intf = (NTP['global']['src_intf']) %}
|
|
{% if ns.source_intf != "" %}
|
|
{% if ns.source_intf == "eth0" %}
|
|
{% set ns.source_intf_ip = 'true' %}
|
|
{% elif ns.source_intf.startswith('Vlan') %}
|
|
{% set ns.source_intf_ip = check_ip_on_interface(ns.source_intf, VLAN_INTERFACE) %}
|
|
{% elif ns.source_intf.startswith('Ethernet') %}
|
|
{% set ns.source_intf_ip = check_ip_on_interface(ns.source_intf, INTERFACE) %}
|
|
{% elif ns.source_intf.startswith('PortChannel') %}
|
|
{% set ns.source_intf_ip = check_ip_on_interface(ns.source_intf, PORTCHANNEL_INTERFACE) %}
|
|
{% elif ns.source_intf.startswith('Loopback') %}
|
|
{% set ns.source_intf_ip = check_ip_on_interface(ns.source_intf, LOOPBACK_INTERFACE) %}
|
|
{% endif %}
|
|
{% endif %}
|
|
{% endif %}
|
|
|
|
{% if ns.source_intf_ip == 'true' %}
|
|
interface listen {{ns.source_intf}}
|
|
{% elif (NTP) and NTP['global']['vrf'] == 'mgmt' %}
|
|
interface listen eth0
|
|
{% elif MGMT_INTERFACE %}
|
|
{% for (mgmt_intf, mgmt_prefix) in MGMT_INTERFACE|pfx_filter %}
|
|
interface listen {{ mgmt_prefix | ip }}
|
|
{% endfor %}
|
|
{% elif LOOPBACK_INTERFACE %}
|
|
{% for (name, prefix) in LOOPBACK_INTERFACE|pfx_filter %}
|
|
{% if prefix | ipv4 and name == 'Loopback0' %}
|
|
interface listen {{ prefix | ip }}
|
|
{% endif %}
|
|
{% endfor %}
|
|
{% else %}
|
|
interface listen eth0
|
|
{% endif %}
|
|
interface listen 127.0.0.1
|
|
|
|
# Access control configuration; see /usr/share/doc/ntp-doc/html/accopt.html for
|
|
# details. The web page <http://support.ntp.org/bin/view/Support/AccessRestrictions>
|
|
# might also be helpful.
|
|
#
|
|
# Note that "restrict" applies to both servers and clients, so a configuration
|
|
# that might be intended to block requests from certain clients could also end
|
|
# up blocking replies from your own upstream servers.
|
|
|
|
# By default, exchange time with everybody, but don't allow configuration.
|
|
restrict -4 default kod notrap nomodify nopeer noquery
|
|
restrict -6 default kod notrap nomodify nopeer noquery
|
|
|
|
# Local users may interrogate the ntp server more closely.
|
|
restrict 127.0.0.1
|
|
restrict ::1
|
|
|
|
# Clients from this (example!) subnet have unlimited access, but only if
|
|
# cryptographically authenticated.
|
|
#restrict 192.168.123.0 mask 255.255.255.0 notrust
|
|
|
|
|
|
# If you want to provide time to your local subnet, change the next line.
|
|
# (Again, the address is an example only.)
|
|
#broadcast 192.168.123.255
|
|
|
|
# If you want to listen to time broadcasts on your local subnet, de-comment the
|
|
# next lines. Please do this only if you trust everybody on the network!
|
|
#disable auth
|
|
#broadcastclient
|