The packet is at best a casual retransmission and at worst a malicious replay. The packet is not a reply to a message previously sent. This can happen when the NTP daemon is restarted and before somebody else notices. One or more timestamp fields are invalid. This normally happens when the first packet from a peer is received.
Access is denied.
See the Access Control Options page. Cryptographic authentication fails. See the Authentication Options page. The server is unsynchronized. Wind up its clock first.