UDP 123, hierarchical strata (0 = reference clock, 1 = attached server, … max 15). Clients measure offset + delay and slew the clock (small steps) rather than jumping it. NTP delivers UTC — local display is clock timezone.

Mode	Direction	Use
ntp server	unidirectional	normal client/server hierarchy
ntp peer	bidirectional	two cores syncing each other
ntp master 5	router becomes the source	isolated sites/fallback only

ntp server 192.0.2.10 prefer
ntp source Loopback0
ntp authentication-key 1 md5 CISCO123
ntp authenticate
ntp trusted-key 1
ntp server 192.0.2.10 key 1

Verify: show ntp status (“Clock is synchronized”), show ntp associations — * selected source, + candidate, ~ peer; the reach field climbing octal tells you reachability history.

Why it matters: logs you can’t correlate are logs you don’t have — plus certificates and Kerberos break on skew.