Skip to main content
Zhuo
Explorer
July 2, 2024
Question

FortiGate NTP config interface-select-method specify

  • July 2, 2024
  • 2 replies
  • 6203 views

Use custom source interface to exit, but the traffic will check the default route and exit through the found route interface, not the custom interface ip.
But after configuring the source ip, there is no problem.

Why is this?

 

config system ntp
set ntpsync enable
set type custom
set syncinterval 1
config ntpserver
edit 1
set server "10.0.0.17"
next
end
set source-ip 10.0.64.114---------------Can
end

------------------------------------------------------------

config system ntp
set ntpsync enable
set type custom
set syncinterval 1
config ntpserver
edit 1
set server "10.0.0.17"
set interface-select-method specify
set interface "port1"----------------------Can't
next
end
end

 

port1=10.0.64.114

2 replies

saneeshpv_FTNT
Staff
Staff
July 2, 2024

Hi @Zhuo 

 

The statement "set interface portx" tell the fortigate which Interface it should listen for incoming NTP traffic (used when Fortigate act as NTP server).

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-a-FortiGate-unit-as-a-NTP-server/ta-p/190313

 

The command "set source-ip <IP>" tells fortigate which IP it should use when it forwards the request to the NTP Configured. So both commands has different use case.

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-control-change-the-FortiGate-source-IP-for/ta-p/194903

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-control-change-the-FortiGate-source-IP-for/ta-p/198426?externalID=FD32459 

 

Best Regards,

Saneesh

 

Zhuo
ZhuoAuthor
Explorer
July 2, 2024

config ntpserver
edit 1
set server "10.0.0.17"
set interface-select-method specify
set interface "port1"
next
I specified the interface in config ntpserver, edit 1, not in config system ntp, set interface "portx". It was not setting the NTP server.

saneeshpv_FTNT
Staff
Staff
July 2, 2024

Hi @Zhuo 

 

The "set interface-select-method" command is used when you have more than one available routes to the destination like in the case of SDWAN and where you want self-orginating traffic to consider SDWAN rules/routes. Here with your setup I am not able to see any route available via the Port1 to reach your NTP server. So specifying that interface will not work as expected. The solution is to use "set source-ip" so the traffic will always leave FGT using this IP as source even though it exit out of Port2 as per your routing.

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Functionality-of-set-interface-select-method-for/ta-p/196731

 

Best Regards,

Saneesh

 

Toshi_Esumi
SuperUser
SuperUser
July 2, 2024

Maybe a knit-picking, but this KB describes only "...(DNS, FortiGuard, RADIUS, LDAP)..." instead of "...(DNS, FortiGuard, RADIUS, LDAP, etc.)..."

Does this apply to NTP traffic as well?

 

Toshi