NTP Sync Issue

[sonydarrel]

Dears,

I am syncing time on fortinet 1200D from Internet servers and i want my fortinet to be a NTP server for all windows servers and Cisco network devices, i have a server vlan which is terminated on cisco core switches as DG for the server vlan  and from core it is a trunk connecting to fortigate with aggregate interfaces for other servers going to the internet.

how i can achieve the configuration of NTP, I think i dont need to create the policies here if i am not wrong becz traffic is not passing through the firewall it just hitting the inside  interface and coming back, from the same interface.

thanks

[emnoc · Accepted solution]

I'm sorry to say that cfg does not look right ;

Here's a correct cfg & bold highlights

config system ntp     set ntpsync enable     set syncinterval 300     set server-mode enable     set interface "wifi"    <-----here defined interface end

[gschmitt]

To use the FortiGate as an NTP server is simple

Go to System > Dashboard > Status and look for the System Information Widget (if you don't have it simply add it with the +Widget button)

Click the little [Change] behind System Time

Check ☑ Enable NTP Server

Select the interfaces in the Listen on Interfaces drop down menu

As long as the client is able to reach the interface on NTP it can get the time from it.

[emnoc]

Correct and more importantly the fortigate need to be  sync to a valid stratum clock. IIRC by default it uses fortiguard for sync but you can double check and ensure the NTP server is enabled for the fortigate it's self. You can validate on a mca/linux device that a valid sync is play using  ntpq or similar tools

e.g ( macosx  10.10.80.1 is  my wifi interface at home FGT60D )

MacBook13:~ kfelix$ ntpq ntpq> peer      remote           refid      st t when poll reach   delay   offset  jitter ==============================================================================  trap.ip6.arpa.n .XFAC.          16 u    - 1024    0    0.000    0.000   0.000  10.10.80.1      129.6.15.30      3 u  126   64   35    1.861  -559.73 1765.69 ntpq>

[sonydarrel]

Dears,

I have done the exact configuration as suggest above but it didn't solve i have one small question pls answer.

i have a core as a trunk port connected to fortigate with sub interfaces, (10.10.11.1) vlan 2 ,, (10.10.12.1) vlan 3.  there is a subnet 10.10.10.1 on core and from core default route to fortigate interface 10.10.11.1,,, and fortigate is pointing to subnet 10.10.10.0 on  core ip (next hop) 10.10.11.2

Ntp server is a fortinet ip 10.10.12.1

I want to reach from subnet 10.10.10.0 on ntp port number 123 to fortinet interface 10.10.11.1

what my thoughts are please correct if i am wrong.

traffic initiating from 10.10.10.3 >>> 10.10.12.1 eq 123  and the return traffic is from the same interface so what things need to configure for establishing the connection.

How i can achieve this.

[gschmitt]

Did you add the VLAN Interfaces to the NTP Configuration?

The NTP Server is reachable on the interface IP of the subnet (vlan)

Basically for the VLAN2 the NTP Server is 10.10.11.1; for VLAN 3 it's 10.10.12.1 and so on.

[sonydarrel]

Dear,

I can see the packets going out to internet ntp server to update time on fortiner but forinet is not sending replies to request which are coming from core switches.

 (ntp) # show config system ntp     set interface "port22"         config ntpserver             edit 1                 set server "pool.time.org"             next         end     set ntpsync enable     set server-mode enable     set syncinterval 10     set type custom end

 # diag sys ntp status HA master: yes, HA master ip: 169.254.0.2, management_vfid: 0 synchronized: no, ntpsync: enabled, server-mode: enabled ipv6 server(pool.time.org) unresolved -- unreachable(0xff) S:0 T:9          no data ipv4 server(pool.time.org) 24.43.69.78 -- reachable(0xff) S:0 T:1          no data

 # diagnose sniffer packet any "port 123" 4 0 l interfaces=[any] filters=[port 123] 2015-08-13 20:45:59.285062 port32 out 10.30.10.226.123 -> 24.43.69.78.123: udp 48 2015-08-13 20:46:15.213063 Point-to-Point in 192.168.181.2.123 -> 192.168.181.1.123: udp 48 2015-08-13 20:46:17.837253 MGMT in 192.168.175.25.123 -> 192.168.180.1.123: udp 48 2015-08-13 20:46:41.285095 port32 out 10.30.10.226.123 -> 24.43.69.78.123: udp 48 2015-08-13 20:47:20.213006 Point-to-Point in 192.168.181.2.123 -> 192.168.181.1.123: udp 48 2015-08-13 20:47:55.285151 port32 out 10.30.10.226.123 -> 24.43.69.78.123: udp 48 2015-08-13 20:48:25.212985 Point-to-Point in 192.168.181.2.123 -> 192.168.181.1.123: udp 48 2015-08-13 20:49:31.212942 Point-to-Point in 192.168.181.2.123 -> 192.168.181.1.123: udp 48 2015-08-13 20:50:13.285256 port32 out 10.30.10.226.123 -> 24.43.69.78.123: udp 48 2015-08-13 20:50:38.212896 Point-to-Point in 192.168.181.2.123 -> 192.168.181.1.123: udp 48

i cannot see any out packets to 192.168.181.2 what can be the reason.

thanks

[emnoc · Accepted solution]

I'm sorry to say that cfg does not look right ;

Here's a correct cfg & bold highlights

config system ntp     set ntpsync enable     set syncinterval 300     set server-mode enable     set interface "wifi"    <-----here defined interface end

[AndreaSoliva · Accepted solution]

Hi

I think that what has to be unterstood is following:

if you have as an example 4 interfaces port1 - 4 and you would like to serve for each segment a ntp server on the interface it is not visible and it will not work if you define port 1 and all other segments would get the time. You can implement of course addtional policeis to get from port 2/3/4 to the port 1 by ntp but it would not work. The reason is behind the config which means a ntp request on a FortiGate would be ONLY ANSWERED coming from the segment going to the interface of the segment and if there a ntp server (configured as ntp listener) is listening it will be answered. This means if you like to have for each segement on a FGT port1/2/3/4 a ntp server you have to configure for the ntp server a listener for each segment like:

config system ntp set ntpsync enable set type custom set syncinterval 360 set server-mode enable set interface "port1 port2 port3 port4" config ntpserver edit 1 set server "ch.pool.ntp.org" next end end

I tried also from a FMG perspective to configure based on a global policy to reach from port4 --> port1 but as you mentioned the ntp request is reaching the port1 but never got back something.

this is my view how it works

kind regards

Andrea

[sonydarrel]

Dears,

when i add a interface,it is sending packets to the internal LAN on Cisco Nexus switches but becz of stratum 16 Nexus switches are not syncing how i can reduce the stratum value on fortinet firewall. also i want to enable authentication for only  internal LAN switches and not to the ( internet servers pool.ntp.org ) how can i achieve that. can anybody insert authentication commands in my exisiting config.

(ntp) # show config system ntp     set interface "port22" "port32"         config ntpserver             edit 1                 set server "pool.time.org"             next

        end     set ntpsync enable     set server-mode enable     set syncinterval 10     set type custom end

[khtaree]

Hi sonydarrel, hi everybody,

Did you resolve that issue.

I have a similar problem with one of my company fortigate firewall.

Thanks for reply

Regards