ESXi時(shí)間同步測試,與Windows搭建的NTP server無法同步的原因

1、ESXi與NTP服務(wù)器同步的抓包測試問題：ESXi配置NTP時(shí)間同步時(shí)，當(dāng)指向由Windows系統(tǒng)搭建的NTP服務(wù)器時(shí)，無法實(shí)現(xiàn)同步，而指向由Linux系統(tǒng)搭建的NTP服務(wù)器時(shí)，則可以實(shí)現(xiàn)同步。為查找問題根源，專門搭建了測試環(huán)境，進(jìn)行抓包分析，研究其中發(fā)生的過程。測試環(huán)境： 序號名稱IP Address系統(tǒng)版本作用1ESXi Server22ESXi5.0ESXi服務(wù)器，作為NTP客戶端2Router1919Windows 2003配置了路由功能，并安裝抓包工具3NTP Server1Win

2、dows2003搭建NTP服務(wù)器4NTP Server2Rhel5.5搭建NTP服務(wù)器拓?fù)鋱D：測試ESXi使用Windows 2003搭建NTP的服務(wù)器按照VMware提供KB的建議， 0 970354356 1.配置Windows 2003，搭建NTP客戶端修改注冊表，步驟如下：1.Enable NTP mode:Locate HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesW32TimeParametersSet the Type value to NTP.2.Enable the NTP Client:Locat

3、e HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesW32TimeConfigSet the AnnounceFlags value to 5.3.Specify the upstream NTP servers to sync from:Locate HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesW32TimeTimeProvidersSet the NtpServer value to a list of at least 3 NTP servers.Example: You might

4、set the value to:,0x1 2.,0x1 3.,0x1Note: On a Windows 2008 Domain Controller, NtpServer is located in HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesW32TimeParameters.4.Specify a 15-minute update interval:Locate HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesW

5、32TimeTimeProvidersNtpClientSet the SpecialPollInterval value to 900.5.Restart the W32time service for the changes to take effect.2.配置ESXi Server，將其NTP服務(wù)器指向由Windows搭建的NTP服務(wù)器1.Open the /etc/ntp.conf file in a text editor. For more information, see Editing configuration files in VMware ESXi and ESX (1

6、017022).2.Add the tos maxdist command on its own line:tos maxdist 303.Save and close the configuration file.4.Make the /etc/likewise/lsassd.conf file writable by running the command:chmod +w /etc/likewise/lsassd.conf5.Open the /etc/likewise/lsassd.conf file in a text editor. For more information, se

7、e Editing configuration files in VMware ESXi and ESX (1017022).6.Locate the sync-system-time option, uncomment it, and set the value to no:sync-system-time = no7.Save and close the configuration file.8.On ESXi, save the configuration changes to the boot bank so they persist across reboots by running

8、 the command:/sbin/auto-backup.sh9.Restart the ntpd and lsassd services for the configuration changes to take effect by running the commands:service lsassd restartservice ntpd restartNote: To restart the ntpd and lsassd services on an ESXi host, run these commands:./etc/init.d/lsassd restart./etc/in

9、it.d/ntpd restart3.配置ESXi的NTP服務(wù)器地址4.監(jiān)控?cái)?shù)據(jù)包只有從ESXi發(fā)出的NTP包，NTP server沒有回復(fù)。5.在KB的基礎(chǔ)上做調(diào)整，修改注冊表，啟動NTP服務(wù)修改注冊表的鍵值:Run->regedit HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesW32Time TimeProvidersNtpServer內(nèi)的Enabled為1，打開NTP服務(wù)器功能（默認(rèn)是不開啟NTP Server服務(wù)重啟W23Time服務(wù)6.啟動NTP服務(wù)后，抓包顯示NTP服務(wù)器有了回復(fù)7.NTP數(shù)據(jù)包ESXi 發(fā)出的NTP請求包

10、是NTP版本4.Windows搭建的NTP Server的響應(yīng)包是NTP版本3ESXi未完成時(shí)間同步，NTP服務(wù)器發(fā)回的響應(yīng)包并未被接受。測試ESXi使用Linux搭建NTP的服務(wù)器1.配置Linux作為NTP服務(wù)器1.編輯ntp.conf2.Ntp.conf配置示例：# Permit time synchronization with our time source, but do not# permit the source to query or modify the service on this system.restrict default nomodify# Permit all

11、 access over the loopback interface. This could# be tightened as well, but to do so would effect some of# the administrative functions.restrict # - CLIENT NETWORK -# Permit systems on this network to synchronize with this# time service. Do not permit those systems to modify the# configurati

12、on of this service. Also, do not use those# systems as peers for synchronization.# restrict mask nomodify notrap# - OUR TIMESERVERS - server 0.server 1.server 2.# - NTP MULTICASTCLIENT -#multicastclient# listen on default # restr

13、ict mask 55 nomodify notrap# restrict mask nomodify notrap# - GENERAL CONFIGURATION -# Undisciplined Local Clock. This is a fake driver intended for backup# and when no outside source of synchronized time is available. The# default stratum is usually

14、3, but in this case we elect to use stratum# 0. Since the server line does not have the prefer keyword, this driver# is never used for synchronization, unless no other other# synchronization source is available. In case the local host is# controlled by some external source, such as an external oscil

15、lator or# another protocol, the prefer keyword would cause the local host to# disregard all other synchronization sources, unless the kernel# modifications are in use and declare an unsynchronized condition.#server# local clockfudge stratum 10# Drift file. Put this in a directo

16、ry which the daemon can write to.# No symbolic links allowed, either, since the daemon updates the file# by creating a temporary in the same directory and then rename()'ing# it to the file.#driftfile /var/lib/ntp/driftbroadcastdelay0.008# Keys file. If you want to diddle your server at run time,

17、 make a# keys file (mode 600 for sure) and define the key number to be# used for making requests.# PLEASE DO NOT USE THE DEFAULT VALUES HERE. Pick your own, or remote# systems might be able to reset your clock at will. Note also that# ntpd is started with a -A flag, disabling authentication, that# will have to be removed as well.#keys/etc/ntp/keys3. Linux防火墻啟動123端口2.更改ESXi的NTP服務(wù)器，將其指向Linux服務(wù)器的IP：3.NTP數(shù)據(jù)包內(nèi)容1. 總共發(fā)了20個(gè)ntp請