NTP not working

[aboodnet]

Dear, 

We want to use Fortigate NTP as the source to synchronize time in our environment. The configuration seems very simple but unfortunately it is not working. Please find the configuration below...

ROM-FG-80E # show system ntp config system ntp set ntpsync enable set syncinterval 2 set source-ip 192.168.2.254         (LAN interface) set server-mode enable set interface "dmz" "lan" end

ROM-FG-80E # diag sys ntp status synchronized: no, ntpsync: enabled, server-mode: enabled

ipv4 server(ntp2.fortiguard.com) 208.91.112.51 -- unreachable(0x0) S:7 T:8 no data ipv4 server(ntp1.fortiguard.com) 208.91.112.50 -- unreachable(0x0) S:7 T:8 no data ipv4 server(ntp2.fortiguard.com) 208.91.113.71 -- unreachable(0x0) S:7 T:8 no data ipv4 server(ntp1.fortiguard.com) 208.91.113.70 -- unreachable(0x0) S:7 T:8 no data

ROM-FG-80E # execute ping ntp2.fortiguard.com PING ntp2.fortinet.net (208.91.112.51): 56 data bytes 64 bytes from 208.91.112.51: icmp_seq=0 ttl=48 time=239.8 ms 64 bytes from 208.91.112.51: icmp_seq=1 ttl=48 time=238.7 ms 64 bytes from 208.91.112.51: icmp_seq=2 ttl=48 time=238.6 ms 64 bytes from 208.91.112.51: icmp_seq=3 ttl=48 time=239.9 ms 64 bytes from 208.91.112.51: icmp_seq=4 ttl=48 time=238.6 ms

Any ideas on how to troubleshoot this?

Thanks in advace,

[Dave_Hall]

Ours is setup similar to ths:

config system ntp     set ntpsync enable     set type custom     set syncinterval 720     config ntpserver         edit 1             set server "ca.pool.ntp.org"         next         edit 2             set server "ntp2.fortinet.net"         next     end     set server-mode enable     set interface "lan" end

[aboodnet]

It is pretty much similar to what we have... 

ROM-FG-80E # config system ntp

ROM-FG-80E (ntp) # show full config system ntp set ntpsync enable set type custom set syncinterval 60 config ntpserver edit 1 set server "time.google.com" set ntpv3 disable next edit 2 set server "ntp2.fortinet.net" set ntpv3 disable next end set source-ip 192.168.1.254 set source-ip6 :: set server-mode enable set interface "lan" end

but still not synchronizing. 

[Dave_Hall]

Perhaps try unsetting the source-ip - I never had to use it and according to KB#FD33783, it sounds like it's only needed for multiple interfaces and/or authentication is used (unless I am reading that wrong).

[aboodnet]

how can i unset it?

[Dave_Hall]

config system ntp unset source-ip end

[aboodnet]

Still not synchronized. Do we need to create a specific policy rule (inbound or outbound) to allow ntp?

[ede_pfau]

Sometimes NTP doesn't sync when the difference between local and real time is too big, i.e. when the clock is way off. Try to set the time manually, re-enable ntp sync, and then watch the ntp sync status.

[aboodnet]

ede_pfau, 

You know i thought of that so i modified the time manually with 10 min time difference but still no luck. 

The problem is that the NTP addresses shows unreachable even thought i can ping them successfully from Firewall CLI so they are reachable. 

synchronized: no, ntpsync: enabled, server-mode: enabled ipv4 server(ntp1.fortiguard.com) 208.91.113.70 -- unreachable(0x0) S:7 T:4 no data ipv4 server(ntp2.fortiguard.com) 208.91.113.71 -- unreachable(0x0) S:7 T:4 no data ipv4 server(ntp2.fortiguard.com) 208.91.112.51 -- unreachable(0x0) S:7 T:4 no data ipv4 server(ntp1.fortiguard.com) 208.91.112.50 -- unreachable(0x0) S:7 T:4 no data

[Dave_Hall]

Check the timezone/DST settings. 

If the timezone looks right, adjust it to some other timezone then change it back.