During an incident review, log timestamps from routers, switches and firewalls disagree by several minutes, and the team suspects a rogue time source could shift clocks to hide activity. What should be configured so devices accept time only from approved servers?

Network Time Protocol can authenticate the packets exchanged between a client and its servers. The administrator defines authentication keys, marks the keys that are trusted, and associates a key with each configured server; the device then synchronizes only to sources whose packets carry a valid authenticator for a trusted key. That keeps clocks consistent across the fleet and prevents an attacker from introducing a rogue server to skew timestamps. Setting clocks manually removes the external attack surface but guarantees drift over time, so timestamps diverge again and correlation fails, which is the original problem. Rewriting events with the collector's receive time hides the symptom in one place, but it discards the device's own event time, introduces transport delay, and does nothing to protect the clocks used for certificates, logs stored locally and other time-dependent functions. Broadcast client mode makes devices listen to any broadcaster on the segment, which increases rather than reduces exposure to a rogue time source unless it is also authenticated. Exam caveat: authentication proves the source, not that the source itself is accurate, so use several reliable upstream servers. Operational check: verify the association shows the server as authenticated and synchronized, confirm the stratum and offset are sensible, and check that log timestamps across devices now align.