Hot!NTP not working

Author
aboodnet
New Member
  • Total Posts : 10
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/04/17 08:12:08
  • Status: offline
2019/04/24 10:23:23 (permalink)
0

NTP not working

Dear, 
 
We want to use Fortigate NTP as the source to synchronize time in our environment. The configuration seems very simple but unfortunately it is not working. Please find the configuration below...
 
ROM-FG-80E # show system ntp
config system ntp
set ntpsync enable
set syncinterval 2
set source-ip 192.168.2.254         (LAN interface)
set server-mode enable
set interface "dmz" "lan"
end
 
ROM-FG-80E # diag sys ntp status
synchronized: no, ntpsync: enabled, server-mode: enabled
ipv4 server(ntp2.fortiguard.com) 208.91.112.51 -- unreachable(0x0) S:7 T:8
no data
ipv4 server(ntp1.fortiguard.com) 208.91.112.50 -- unreachable(0x0) S:7 T:8
no data
ipv4 server(ntp2.fortiguard.com) 208.91.113.71 -- unreachable(0x0) S:7 T:8
no data
ipv4 server(ntp1.fortiguard.com) 208.91.113.70 -- unreachable(0x0) S:7 T:8
no data
 
 
ROM-FG-80E # execute ping ntp2.fortiguard.com
PING ntp2.fortinet.net (208.91.112.51): 56 data bytes
64 bytes from 208.91.112.51: icmp_seq=0 ttl=48 time=239.8 ms
64 bytes from 208.91.112.51: icmp_seq=1 ttl=48 time=238.7 ms
64 bytes from 208.91.112.51: icmp_seq=2 ttl=48 time=238.6 ms
64 bytes from 208.91.112.51: icmp_seq=3 ttl=48 time=239.9 ms
64 bytes from 208.91.112.51: icmp_seq=4 ttl=48 time=238.6 ms
 
 
Any ideas on how to troubleshoot this?
 
Thanks in advace,
#1

11 Replies Related Threads

    Dave Hall
    Expert Member
    • Total Posts : 1390
    • Scores: 150
    • Reward points: 0
    • Joined: 2012/05/11 07:55:58
    • Location: Canada
    • Status: offline
    Re: NTP not working 2019/04/24 11:57:29 (permalink)
    0
    Ours is setup similar to ths:
     
    config system ntp
        set ntpsync enable
        set type custom
        set syncinterval 720
        config ntpserver
            edit 1
                set server "ca.pool.ntp.org"
            next
            edit 2
                set server "ntp2.fortinet.net"
            next
        end
        set server-mode enable
        set interface "lan"
    end




    NSE4/FMG-VM64/FortiAnalyzer-VM/5.2/5.4 (FWF40C/FW92D/FGT200B/FGT200D/FGT101E)/ FAP220B/221C
    #2
    aboodnet
    New Member
    • Total Posts : 10
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/04/17 08:12:08
    • Status: offline
    Re: NTP not working 2019/04/24 12:04:17 (permalink)
    0
    It is pretty much similar to what we have... 
     
    ROM-FG-80E # config system ntp
    ROM-FG-80E (ntp) # show full
    config system ntp
    set ntpsync enable
    set type custom
    set syncinterval 60
    config ntpserver
    edit 1
    set server "time.google.com"
    set ntpv3 disable
    next
    edit 2
    set server "ntp2.fortinet.net"
    set ntpv3 disable
    next
    end
    set source-ip 192.168.1.254
    set source-ip6 ::
    set server-mode enable
    set interface "lan"
    end
     
    but still not synchronizing. 
    #3
    Dave Hall
    Expert Member
    • Total Posts : 1390
    • Scores: 150
    • Reward points: 0
    • Joined: 2012/05/11 07:55:58
    • Location: Canada
    • Status: offline
    Re: NTP not working 2019/04/24 12:28:09 (permalink)
    0
    Perhaps try unsetting the source-ip - I never had to use it and according to KB#FD33783, it sounds like it's only needed for multiple interfaces and/or authentication is used (unless I am reading that wrong).

    NSE4/FMG-VM64/FortiAnalyzer-VM/5.2/5.4 (FWF40C/FW92D/FGT200B/FGT200D/FGT101E)/ FAP220B/221C
    #4
    aboodnet
    New Member
    • Total Posts : 10
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/04/17 08:12:08
    • Status: offline
    Re: NTP not working 2019/04/24 12:32:56 (permalink)
    0
    how can i unset it?
    #5
    Dave Hall
    Expert Member
    • Total Posts : 1390
    • Scores: 150
    • Reward points: 0
    • Joined: 2012/05/11 07:55:58
    • Location: Canada
    • Status: offline
    Re: NTP not working 2019/04/24 12:51:08 (permalink)
    0
     
    config system ntp
    unset source-ip
    end



    NSE4/FMG-VM64/FortiAnalyzer-VM/5.2/5.4 (FWF40C/FW92D/FGT200B/FGT200D/FGT101E)/ FAP220B/221C
    #6
    aboodnet
    New Member
    • Total Posts : 10
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/04/17 08:12:08
    • Status: offline
    Re: NTP not working 2019/04/24 20:40:49 (permalink)
    0
    Still not synchronized. Do we need to create a specific policy rule (inbound or outbound) to allow ntp?
    #7
    ede_pfau
    Expert Member
    • Total Posts : 5929
    • Scores: 466
    • Reward points: 0
    • Joined: 2004/03/09 01:20:18
    • Location: Heidelberg, Germany
    • Status: offline
    Re: NTP not working 2019/04/25 04:08:17 (permalink)
    0
    Sometimes NTP doesn't sync when the difference between local and real time is too big, i.e. when the clock is way off. Try to set the time manually, re-enable ntp sync, and then watch the ntp sync status.

    Ede

    " Kernel panic: Aiee, killing interrupt handler!"
    #8
    aboodnet
    New Member
    • Total Posts : 10
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/04/17 08:12:08
    • Status: offline
    Re: NTP not working 2019/04/25 04:18:58 (permalink)
    0
    ede_pfau, 
     
    You know i thought of that so i modified the time manually with 10 min time difference but still no luck. 
     
    The problem is that the NTP addresses shows unreachable even thought i can ping them successfully from Firewall CLI so they are reachable. 
     
    synchronized: no, ntpsync: enabled, server-mode: enabled

    ipv4 server(ntp1.fortiguard.com) 208.91.113.70 -- unreachable(0x0) S:7 T:4
    no data
    ipv4 server(ntp2.fortiguard.com) 208.91.113.71 -- unreachable(0x0) S:7 T:4
    no data
    ipv4 server(ntp2.fortiguard.com) 208.91.112.51 -- unreachable(0x0) S:7 T:4
    no data
    ipv4 server(ntp1.fortiguard.com) 208.91.112.50 -- unreachable(0x0) S:7 T:4
    no data
     
    #9
    Dave Hall
    Expert Member
    • Total Posts : 1390
    • Scores: 150
    • Reward points: 0
    • Joined: 2012/05/11 07:55:58
    • Location: Canada
    • Status: offline
    Re: NTP not working 2019/04/25 08:10:13 (permalink)
    0
    Check the timezone/DST settings. 
     
    If the timezone looks right, adjust it to some other timezone then change it back.
     

    NSE4/FMG-VM64/FortiAnalyzer-VM/5.2/5.4 (FWF40C/FW92D/FGT200B/FGT200D/FGT101E)/ FAP220B/221C
    #10
    ede_pfau
    Expert Member
    • Total Posts : 5929
    • Scores: 466
    • Reward points: 0
    • Joined: 2004/03/09 01:20:18
    • Location: Heidelberg, Germany
    • Status: offline
    Re: NTP not working 2019/04/26 06:38:06 (permalink)
    0
    Could you sniff the traffic to a known NTP server? Like
    di de en
    di sniff packet wan1 'port 123 and host 192.53.103.104' 4 0 l ("ell")

     
    This will only show the sync traffic, no pings.
     
    Your problem is strange, in that NTP is almost always working immediately. I've seen on one occasion that the NTP server responded with "Too many connections", as a huge network was accessing it through the same, single public address via NAT. This can be avoided by directing clients to the FGT, and only the FGT querying the NTP server.

    Ede

    " Kernel panic: Aiee, killing interrupt handler!"
    #11
    rwpatterson
    Expert Member
    • Total Posts : 8359
    • Scores: 197
    • Reward points: 0
    • Joined: 2006/08/08 10:08:18
    • Location: Long Island, New York, USA
    • Status: offline
    Re: NTP not working 2019/04/26 08:43:59 (permalink)
    0
    Have you tried different NTP servers? i.e. pool.ntp.org.
     
    https://www.ntppool.org/en/
     

    -Bob - self proclaimed posting junkie!
    See my Fortigate related scripts at: http://fortigate.camerabob.com

    -4.3.19-b0694
    FWF60B
    FWF80CM (4)
    FWF81CM (2)
     
    #12
    Jump to:
    © 2019 APG vNext Commercial Version 5.5