11.5.9 NTP client and server support on the HMC HMC NTP broadband authentication support Authentication support with a proxy Authentication support with a firewall NTP symmetric key and autokey authentication The NTP client support allows a STP-only CTN to use an NTP server as an ETS. This  capability addresses the following requirements: The NTP server becomes the single time source (the ETS) for STP and other servers that are  not IBM Z servers (such as AIXfi, and Micr osoft Windows) that include NTP clients. The HMC can act as an NTP server. With this support, the z14 server can receive the time  from the HMC without accessing a LAN other than the HMC and SE network. When the HMC  is used as an NTP server, it can be configured to receive the NTP source from the internet.  For this type of configuration, a LAN that is separate from the HMC/SE LAN can be used.  HMC NTP authentication can be used since HMC Driver 15. The SE NTP support is  unchanged. To use this option on the SE, configure the HMC with this option as an NTP  server for the SE. Some client configurations use a proxy for external access outside the corporate data center.  NTP requests are User Datagram Protocol (UDP) socket packets and cannot pass through  the proxy. The proxy must be configured as an NTP server to get to target servers on the web.  Authentication can be set up on the client’s proxy to communicate with the target time  sources.  If you use a firewall, HMC NTP requests can pass through it. Use HMC authentication to  ensure untampered time stamps. With symmetric key and autokey authentication, the highest level of NTP security is available.  HMC Level 2.12.0 and later provide windows that accept and generate key information to be  configured into the HMC NTP configuration. They can also issue NTP commands. The HMC offers the following symmetric key and autokey authentication and NTP commands: Symmetric key authentication is described in RFC 1305, which was made available in  NTP Version 3. Symmetric key encryption uses the same key for encryption and  decryption. Users that are exchanging data keep this key to themselves. Messages  encrypted with a secret key can be decrypted only with the same secret key. Symmetric  key authentication supports network address translation (NAT). This autokey uses public key cryptography, as described in RFC 5906, which was made  available in NTP Version 4. You can generate keys for the HMC NTP by clicking  Generate Local Host Key  in the Autokey Configuration window. This option issues the  ntp-keygen command to generate the specific key and certificate for this system. Autokey  authentication is not available with the NAT firewall. NTP command support is added to display the status of remote NTP servers and the  current NTP server (HMC). GLYPH<SM590000> Symmetric key (NTP V3-V4) authentication GLYPH<SM590000> Symmetric key autokey (NTP V4) authentication GLYPH<SM590000> Issue NTP commands Chapter 11. Hardware Management Console and Support Elements  439 GLYPH<SM590000> Clients who want time accuracy for the STP-only CTN GLYPH<SM590000> Clients who use a common time reference across heterogeneous systems