Technical Tip: Configuring a FortiGate unit as a NTP server

Description

This article describes how to configure FortiGate as an NTP server.

Scope

FortiGate.

Solution

FortiGate can be used as an authoritative NTP source for other clients.

In this setup, 'port1' is the interface connected to the internet, and 'port2' is the LAN interface (where clients are connected).

The first step is to make sure the local time configuration is correct:

• Configure the correct time zone
• Select the servers that FortiGate will use to synchronize its own time
• Sync interval.

1. Standard NTP configuration:

Below is an example of configuration which uses:

• Time Zone GMT+1.
  
• FortiGuard servers to synchronize (default).
• Synchronize the time every 30 minutes.
  
  

2. Custom NTP configuration. One can also configure custom NTP servers that the FortiGate will use to synchronize its own time. This is only configurable from the CLI:

config system ntp

set ntpsync enable

set type custom

config ntpserver

 edit 1

set server "ntpserver.local"

next

end

set server-mode enable

set interface "port2"

end

3. Quick troubleshooting
   
   Once this is configured, the client NTP has to be configured with the IP address of the FortiGate port2 interface.
   It is possible to verify the synchronization status from the FortiGate using “diag sys ntp status”.
   

Note:

VLAN interface has to be added under 'Listen on Interface', if users are connected via VLAN.