Skip to main content
HelpMe
HelpMe
New Member
September 11, 2022
Question

NTP Server Does Not Sync

  • September 11, 2022
  • 2 replies
  • 7294 views

I spent an hour on a call with TAC and he could not figure out why NTP didn't sync.   We had 3 different versions of the software on the box as I was also doing an upgrade so none of them could sync to the servers.   We used multiple server sources.  Anyone?

 

 

config system ntp
set ntpsync enable
set syncinterval 1

 

diag sys ntp status
synchronized: no, ntpsync: enabled, server-mode: disabled

ipv4 server(ntp1.fortiguard.com) 208.91.112.61 -- reachable(0xff) S:0 T:3
no data
ipv4 server(ntp2.fortiguard.com) 208.91.112.60 -- reachable(0xff) S:0 T:3
no data
ipv4 server(ntp2.fortiguard.com) 208.91.112.62 -- reachable(0xff) S:0 T:3
no data
ipv4 server(ntp1.fortiguard.com) 208.91.112.63 -- reachable(0xff) S:0 T:3
no data

2 replies

gfleming
Staff
gfleming
Staff
September 11, 2022

Have you tried different NTP servers?

HelpMe
HelpMeAuthor
New Member
September 11, 2022

@gfleming Yes.  What does an NTP sync configuration that works look like?  

gfleming
Staff
gfleming
Staff
September 12, 2022

Here's mine:

 

 # diagnose sys ntp status

synchronized: yes, ntpsync: enabled, server-mode: enabled
ipv4 server(ntp1.fortiguard.com) 208.91.112.61 -- reachable(0xff) S:5 T:147
  server-version=4, stratum=2
  reference time is e6c929dd.4782c08f -- UTC Mon Sep 12 03:45:33 2022
  clock offset is 0.009492 sec, root delay is 0.000305 sec
  root dispersion is 0.010422 sec, peer dispersion is 790 msec  

 

Can you run a packet capture on your WAN interface to see what's happening with the NTP packets? Or have you done this already?

 

Vichu_94
Staff
Vichu_94
Staff
September 12, 2022

Hi 

You could configure a source ip address on the NTP server configuration on the firewall and it will allow the firewall to send the traffic using that source ip towards the internet. Since you have the default configuration on the firewall 

config system ntp
set source-ip x.x.x.x
end

If you still face the issue, you run the sniffer command to check if there is NTP traffic sent out from the firewall

di sniffer packet any "port 123" 6 0 a

Terms & ConditionsAccessibility statement