NTP Server Does Not Sync

[HelpMe]

I spent an hour on a call with TAC and he could not figure out why NTP didn't sync.   We had 3 different versions of the software on the box as I was also doing an upgrade so none of them could sync to the servers.   We used multiple server sources.  Anyone?

config system ntp
set ntpsync enable
set syncinterval 1

diag sys ntp status
synchronized: no, ntpsync: enabled, server-mode: disabled

ipv4 server(ntp1.fortiguard.com) 208.91.112.61 -- reachable(0xff) S:0 T:3
no data
ipv4 server(ntp2.fortiguard.com) 208.91.112.60 -- reachable(0xff) S:0 T:3
no data
ipv4 server(ntp2.fortiguard.com) 208.91.112.62 -- reachable(0xff) S:0 T:3
no data
ipv4 server(ntp1.fortiguard.com) 208.91.112.63 -- reachable(0xff) S:0 T:3
no data

[gfleming]

Have you tried different NTP servers?

[HelpMe]

@gfleming Yes.  What does an NTP sync configuration that works look like?  

[gfleming]

Here's mine:

 # diagnose sys ntp status

synchronized: yes, ntpsync: enabled, server-mode: enabled
ipv4 server(ntp1.fortiguard.com) 208.91.112.61 -- reachable(0xff) S:5 T:147
  server-version=4, stratum=2
  reference time is e6c929dd.4782c08f -- UTC Mon Sep 12 03:45:33 2022
  clock offset is 0.009492 sec, root delay is 0.000305 sec
  root dispersion is 0.010422 sec, peer dispersion is 790 msec  

Can you run a packet capture on your WAN interface to see what's happening with the NTP packets? Or have you done this already?

[HelpMe]

Do you have an outbound rule for ntp?

[gfleming]

I do not. Have tried running a packet cap to see what's going on?

[Vichu_94]

Hi 

You could configure a source ip address on the NTP server configuration on the firewall and it will allow the firewall to send the traffic using that source ip towards the internet. Since you have the default configuration on the firewall 

config system ntp
set source-ip x.x.x.x
end

If you still face the issue, you run the sniffer command to check if there is NTP traffic sent out from the firewall

di sniffer packet any "port 123" 6 0 a