49Parameterspeer: Allows time requests and NTP control queries (such as alarms, authentication status, and timeserver information) and allows the local device to synchronize itself to a peer device.query: Allows only NTP control queries from a peer device to the local device.server: Allows time requests and NTP control queries, but does not allow the local device to synchronizeitself to a peer device.synchronization: Allows only time requests from a system whose address passes the access list criteria.acl-number: Specifies an ACL. The peer devices that match the ACL have the access right specified in thiscommand. The acl-number argument represents a basic ACL number, in the range of 2000 to 2999.Usage guidelinesYou can control IPv6 NTP access by using Access Control List (ACL). The access rights are in the followingorder, from least restrictive to most restrictive: peer, server, synchronization, and query.The device processes an NTP request by following these rules:• If no NTP access control is configured, peer is granted to the local device and peer devices.• If the IP address of the peer device matches a permit statement in an ACL for more than one accessright, the least restrictive access right is granted to the peer device. If a deny statement or no ACL ismatched, no access right is granted.• If no ACL is created for a specific access right, the associated access right is not granted.• If no ACL is created for any access right, peer is granted.The ntp-service ipv6 acl command provides a minimum security method. NTP authentication is moresecure.Examples# Configure the peer devices on subnet 2001::1 to have full access to the local device. system-view[Sysname] acl ipv6 number 2001[Sysname-acl6-basic-2001] rule permit source 2001::1 64[Sysname-acl6-basic-2001] quit[Sysname] ntp-service ipv6 peer acl 2001Related commands• ntp-service authentication enable• ntp-service authentication-keyid• ntp-service reliable authentication-keyidntp-service inbound disableUse the ntp-service ipv6 inbound disable command to disable an interface from receiving IPv6 NTPmessages.Use the undo ntp-service ipv6 inbound disable command to restore the default.Syntaxntp-service ipv6 inbound disableundo ntp-service ipv6 inbound disable
