NTP Sync Issue

To use the FortiGate as an NTP server is simple

Go to System > Dashboard > Status and look for the System Information Widget (if you don't have it simply add it with the +Widget button)

Click the little [Change] behind System Time

Check ☑ Enable NTP Server

Select the interfaces in the Listen on Interfaces drop down menu

As long as the client is able to reach the interface on NTP it can get the time from it.

Correct and more importantly the fortigate need to be  sync to a valid stratum clock. IIRC by default it uses fortiguard for sync but you can double check and ensure the NTP server is enabled for the fortigate it's self. You can validate on a mca/linux device that a valid sync is play using  ntpq or similar tools

e.g ( macosx  10.10.80.1 is  my wifi interface at home FGT60D )

MacBook13:~ kfelix$ ntpq ntpq> peer      remote           refid      st t when poll reach   delay   offset  jitter ==============================================================================  trap.ip6.arpa.n .XFAC.          16 u    - 1024    0    0.000    0.000   0.000  10.10.80.1      129.6.15.30      3 u  126   64   35    1.861  -559.73 1765.69 ntpq>

Dears,

I have done the exact configuration as suggest above but it didn't solve i have one small question pls answer.

i have a core as a trunk port connected to fortigate with sub interfaces, (10.10.11.1) vlan 2 ,, (10.10.12.1) vlan 3.  there is a subnet 10.10.10.1 on core and from core default route to fortigate interface 10.10.11.1,,, and fortigate is pointing to subnet 10.10.10.0 on  core ip (next hop) 10.10.11.2

Ntp server is a fortinet ip 10.10.12.1

I want to reach from subnet 10.10.10.0 on ntp port number 123 to fortinet interface 10.10.11.1

what my thoughts are please correct if i am wrong.

traffic initiating from 10.10.10.3 >>> 10.10.12.1 eq 123  and the return traffic is from the same interface so what things need to configure for establishing the connection.

How i can achieve this.

Hi

I think that what has to be unterstood is following:

if you have as an example 4 interfaces port1 - 4 and you would like to serve for each segment a ntp server on the interface it is not visible and it will not work if you define port 1 and all other segments would get the time. You can implement of course addtional policeis to get from port 2/3/4 to the port 1 by ntp but it would not work. The reason is behind the config which means a ntp request on a FortiGate would be ONLY ANSWERED coming from the segment going to the interface of the segment and if there a ntp server (configured as ntp listener) is listening it will be answered. This means if you like to have for each segement on a FGT port1/2/3/4 a ntp server you have to configure for the ntp server a listener for each segment like:

config system ntp set ntpsync enable set type custom set syncinterval 360 set server-mode enable set interface "port1 port2 port3 port4" config ntpserver edit 1 set server "ch.pool.ntp.org" next end end

I tried also from a FMG perspective to configure based on a global policy to reach from port4 --> port1 but as you mentioned the ntp request is reaching the port1 but never got back something.

this is my view how it works

kind regards

Andrea

Dears,

when i add a interface,it is sending packets to the internal LAN on Cisco Nexus switches but becz of stratum 16 Nexus switches are not syncing how i can reduce the stratum value on fortinet firewall. also i want to enable authentication for only  internal LAN switches and not to the ( internet servers pool.ntp.org ) how can i achieve that. can anybody insert authentication commands in my exisiting config.

(ntp) # show config system ntp     set interface "port22" "port32"         config ntpserver             edit 1                 set server "pool.time.org"             next

        end     set ntpsync enable     set server-mode enable     set syncinterval 10     set type custom end