NTP source Interface

[flamer]

Hi guys,

we have fortigates with vdom enabled, but no interfaces in the root/global vdom. What we have discovered is ntp does not sync. When i try and source the NTP from any of the fortigates IP addresses i get the error: "node_check_object fail! for source-ip"

I suspect the issue is that without any interface sin the root vdom, it has no ability to get NTP. Is there any workaround for this? (We do use fortimanager can we grab NTP sync from that since fortimanager communication is working?)

thanks

[EMES]

You must have an interface in the mgmt vdom(root by default) You can change the management vdom in the vdom settings to a different vdom, that would fix it. Then source it form the interface IP of your choice.

[anelis]

The management VDOM is by default the VDOM "root". It uses that management vdom to communicate to fortiguard, dns, ntp and perhaps other things.

In your case you can either change the management vdom to whatever VDOM you're using to manage the firewall

config global

config sys global

set management-vdom ANOTHERVDOM

Or you could also have at least an inter-vdom link to your root vdom with an IP to some VDOM with an internet connection attached to it.

Also keep in mind that in each section "system dns", "system ntp" you have the "source-ip" option that allows you to specify the IP address and thus the outgoing interface on your management vdom.