AOS must authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.

If NTP is not authenticated, an attacker can introduce a rogue NTP server. This rogue server can then be used to send incorrect time information to network devices, which will make log timestamps inaccurate and affect scheduled actions. NTP authentication is used to prevent this tampering by authenticating the time source.

1. Verify the AOS configuration with the following command: show ntp status

If "Authentication" shows "disabled", this is a finding.

2. show running-config | include ntp

If at least one trusted NTP authentication-key is not configured and at least one NTP server configured to use the key, this is a finding.

Configure AOS with the following commands: configure terminal ntp authentication-key (keyid #> sha1 <plaintext key> ntp trusted-key <keyid #> ntp server <first fqdn, ipv4, or ipv6 address> key <keyid #> ntp server <second fqdn, ipv4, or ipv6 address> key <keyid #> ntp authenticate write memory