Dears,
I am syncing time on fortinet 1200D from Internet servers and i want my fortinet to be a NTP server for all windows servers and Cisco network devices, i have a server vlan which is terminated on cisco core switches as DG for the server vlan and from core it is a trunk connecting to fortigate with aggregate interfaces for other servers going to the internet.
how i can achieve the configuration of NTP, I think i dont need to create the policies here if i am not wrong becz traffic is not passing through the firewall it just hitting the inside interface and coming back, from the same interface.
thanks
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
I'm sorry to say that cfg does not look right ;
Here's a correct cfg & bold highlights
config system ntp set ntpsync enable set syncinterval 300 set server-mode enable set interface "wifi" <-----here defined interface end
PCNSE
NSE
StrongSwan
Hi
I think that what has to be unterstood is following:
if you have as an example 4 interfaces port1 - 4 and you would like to serve for each segment a ntp server on the interface it is not visible and it will not work if you define port 1 and all other segments would get the time. You can implement of course addtional policeis to get from port 2/3/4 to the port 1 by ntp but it would not work. The reason is behind the config which means a ntp request on a FortiGate would be ONLY ANSWERED coming from the segment going to the interface of the segment and if there a ntp server (configured as ntp listener) is listening it will be answered. This means if you like to have for each segement on a FGT port1/2/3/4 a ntp server you have to configure for the ntp server a listener for each segment like:
config system ntp set ntpsync enable set type custom set syncinterval 360 set server-mode enable set interface "port1 port2 port3 port4" config ntpserver edit 1 set server "ch.pool.ntp.org" next end end
I tried also from a FMG perspective to configure based on a global policy to reach from port4 --> port1 but as you mentioned the ntp request is reaching the port1 but never got back something.
this is my view how it works
kind regards
Andrea
To use the FortiGate as an NTP server is simple
Go to System > Dashboard > Status and look for the System Information Widget (if you don't have it simply add it with the +Widget button)
Click the little [Change] behind System Time
Check ☑ Enable NTP Server
Select the interfaces in the Listen on Interfaces drop down menu
As long as the client is able to reach the interface on NTP it can get the time from it.
Correct and more importantly the fortigate need to be sync to a valid stratum clock. IIRC by default it uses fortiguard for sync but you can double check and ensure the NTP server is enabled for the fortigate it's self. You can validate on a mca/linux device that a valid sync is play using ntpq or similar tools
e.g ( macosx 10.10.80.1 is my wifi interface at home FGT60D )
MacBook13:~ kfelix$ ntpq ntpq> peer remote refid st t when poll reach delay offset jitter ============================================================================== trap.ip6.arpa.n .XFAC. 16 u - 1024 0 0.000 0.000 0.000 10.10.80.1 129.6.15.30 3 u 126 64 35 1.861 -559.73 1765.69 ntpq>
PCNSE
NSE
StrongSwan
Dears,
I have done the exact configuration as suggest above but it didn't solve i have one small question pls answer.
i have a core as a trunk port connected to fortigate with sub interfaces, (10.10.11.1) vlan 2 ,, (10.10.12.1) vlan 3. there is a subnet 10.10.10.1 on core and from core default route to fortigate interface 10.10.11.1,,, and fortigate is pointing to subnet 10.10.10.0 on core ip (next hop) 10.10.11.2
Ntp server is a fortinet ip 10.10.12.1
I want to reach from subnet 10.10.10.0 on ntp port number 123 to fortinet interface 10.10.11.1
what my thoughts are please correct if i am wrong.
traffic initiating from 10.10.10.3 >>> 10.10.12.1 eq 123 and the return traffic is from the same interface so what things need to configure for establishing the connection.
How i can achieve this.
Did you add the VLAN Interfaces to the NTP Configuration?
The NTP Server is reachable on the interface IP of the subnet (vlan)
Basically for the VLAN2 the NTP Server is 10.10.11.1; for VLAN 3 it's 10.10.12.1 and so on.
Dear,
I can see the packets going out to internet ntp server to update time on fortiner but forinet is not sending replies to request which are coming from core switches.
(ntp) # show config system ntp set interface "port22" config ntpserver edit 1 set server "pool.time.org" next end set ntpsync enable set server-mode enable set syncinterval 10 set type custom end
# diag sys ntp status HA master: yes, HA master ip: 169.254.0.2, management_vfid: 0 synchronized: no, ntpsync: enabled, server-mode: enabled ipv6 server(pool.time.org) unresolved -- unreachable(0xff) S:0 T:9 no data ipv4 server(pool.time.org) 24.43.69.78 -- reachable(0xff) S:0 T:1 no data
# diagnose sniffer packet any "port 123" 4 0 l interfaces=[any] filters=[port 123] 2015-08-13 20:45:59.285062 port32 out 10.30.10.226.123 -> 24.43.69.78.123: udp 48 2015-08-13 20:46:15.213063 Point-to-Point in 192.168.181.2.123 -> 192.168.181.1.123: udp 48 2015-08-13 20:46:17.837253 MGMT in 192.168.175.25.123 -> 192.168.180.1.123: udp 48 2015-08-13 20:46:41.285095 port32 out 10.30.10.226.123 -> 24.43.69.78.123: udp 48 2015-08-13 20:47:20.213006 Point-to-Point in 192.168.181.2.123 -> 192.168.181.1.123: udp 48 2015-08-13 20:47:55.285151 port32 out 10.30.10.226.123 -> 24.43.69.78.123: udp 48 2015-08-13 20:48:25.212985 Point-to-Point in 192.168.181.2.123 -> 192.168.181.1.123: udp 48 2015-08-13 20:49:31.212942 Point-to-Point in 192.168.181.2.123 -> 192.168.181.1.123: udp 48 2015-08-13 20:50:13.285256 port32 out 10.30.10.226.123 -> 24.43.69.78.123: udp 48 2015-08-13 20:50:38.212896 Point-to-Point in 192.168.181.2.123 -> 192.168.181.1.123: udp 48
i cannot see any out packets to 192.168.181.2 what can be the reason.
thanks
I'm sorry to say that cfg does not look right ;
Here's a correct cfg & bold highlights
config system ntp set ntpsync enable set syncinterval 300 set server-mode enable set interface "wifi" <-----here defined interface end
PCNSE
NSE
StrongSwan
Hi
I think that what has to be unterstood is following:
if you have as an example 4 interfaces port1 - 4 and you would like to serve for each segment a ntp server on the interface it is not visible and it will not work if you define port 1 and all other segments would get the time. You can implement of course addtional policeis to get from port 2/3/4 to the port 1 by ntp but it would not work. The reason is behind the config which means a ntp request on a FortiGate would be ONLY ANSWERED coming from the segment going to the interface of the segment and if there a ntp server (configured as ntp listener) is listening it will be answered. This means if you like to have for each segement on a FGT port1/2/3/4 a ntp server you have to configure for the ntp server a listener for each segment like:
config system ntp set ntpsync enable set type custom set syncinterval 360 set server-mode enable set interface "port1 port2 port3 port4" config ntpserver edit 1 set server "ch.pool.ntp.org" next end end
I tried also from a FMG perspective to configure based on a global policy to reach from port4 --> port1 but as you mentioned the ntp request is reaching the port1 but never got back something.
this is my view how it works
kind regards
Andrea
Dears,
when i add a interface,it is sending packets to the internal LAN on Cisco Nexus switches but becz of stratum 16 Nexus switches are not syncing how i can reduce the stratum value on fortinet firewall. also i want to enable authentication for only internal LAN switches and not to the ( internet servers pool.ntp.org ) how can i achieve that. can anybody insert authentication commands in my exisiting config.
(ntp) # show config system ntp set interface "port22" "port32" config ntpserver edit 1 set server "pool.time.org" next
end set ntpsync enable set server-mode enable set syncinterval 10 set type custom end
Hi sonydarrel, hi everybody,
Did you resolve that issue.
I have a similar problem with one of my company fortigate firewall.
Thanks for reply
Regards
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1643 | |
1069 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.