Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 10 replies
  • Answers 3 answers
  • Subscribers 42 subscribers
  • Views 11958 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

LAN Clients unable to receive External NTP Server Time

Brad Peter

Hello,

Recently moved from UTM to XG and I'm encountering an issue where my LAN clients are unable to receive NTP replied from NTP servers.  I did not have this issue in UTM.

My general rule setup is to allow any LAN client unrestricted access to the internet.  When viewing the logs, port 123 traffic is allowed outbound, but does not appear that any client is recieiving the reply.  I have no other known issues connecting to the internet for any other services.  The Sophos XG appliance is able to get accurate time from NTP servers.

Are there any configurations I should be making to allow NTP for the LAN clients?

Thanks!

Brad



This thread was automatically locked due to age.
Parents
  • 0

    Hi,

    are you using the XG supplied definition of NTP or did you create your own? NTP needs to be UDP.

    Ian

    XG115W - v20.0.3 MR-3 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    I have created a custom service for NTP mirroring the XG rule, with UDP and TCP at 1:65535/123.

    I have examined the packet captures and there are no dropped packets on 123 and it appears that all traffic is being passed appropriately (e.g.  I see the NTP packet outbound and the reply back to the WAN IP address).  It just never makes it back to the internal client system.  I have a number of different OSes and each one of them is unable to receive the NTP data  I've verified local OS firewalls are off, etc.

  • 0 in reply to Brad Peter

    Did you create the associated network policy with it?  Or Step 2 in here: https://community.sophos.com/kb/en-us/123034

    Respectfully, 

     

    Badrobot

     

  • 0 in reply to Brad Peter

    Hi,

    Once a connection is established you do not see traffic in both directions unless you are using an analyser. Logviewer only shows the connection and because it is created from your devices there is never any returned traffic showing.

    Why do you think that the devices are not receiving the NTP updates?

    Ian

    XG115W - v20.0.3 MR-3 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    I run an ESX server at home along with a virtual Windows Domain Controller.  Shortly following my move to XG from UTM, my PC clients all started showing about 10 minutes fast.  This is what led me to begin investigating the NTP issue.

    Within ESX i can watch ntpq and they sit at RefID .INIT. for a very long time.  At some point they will return an IP address, but it is many hours before it pulls a valid time from source and each successful poll is also hours apart from the previous poll.  At the time of this writing, here is the ntpq output (the "when" is showing 16 hours since last poll):

    remote              refid              st t   when poll reach delay      offset    jitter
    ==============================================================================
    ntp.wdc1.us.lea 130.133.1.10  2  u    16h  64        0 44.178   59.819  0.000

    My Windows Domain controllers also will not sync with an external time server in a timely fashion as it had before.  Performing a w32tm /resync returns "The computer did not resync because no time data was available."  But, as with the ESX host, it does get a response periodically.

    It's almost as if the return time data is passed along intermittently.  One thing I've thought of, and before I move to look into this, I'd like to pose this question:  I'm running ESX on a 4-core single-socket CPU.  Understanding that NTP is UDP,  How sensitive are XG virtual appliances to higher load averages with respect to UDP traffic?  If the LA is high (2-3 on single vCPU), will the firewall appliance drop packets in favor of TCP traffic?  Would I expect to see these drops anywhere in a log, or are they just silently dropped?

    SFVH_VM01_SFOS 17.5.7 MR-7# uptime
    08:20:54 up 3 days, 20:56, load average: 3.30, 2.90, 2.79

    CPU usage is around 10-20% on average.

Reply
  • 0 in reply to rfcat_vk

    I run an ESX server at home along with a virtual Windows Domain Controller.  Shortly following my move to XG from UTM, my PC clients all started showing about 10 minutes fast.  This is what led me to begin investigating the NTP issue.

    Within ESX i can watch ntpq and they sit at RefID .INIT. for a very long time.  At some point they will return an IP address, but it is many hours before it pulls a valid time from source and each successful poll is also hours apart from the previous poll.  At the time of this writing, here is the ntpq output (the "when" is showing 16 hours since last poll):

    remote              refid              st t   when poll reach delay      offset    jitter
    ==============================================================================
    ntp.wdc1.us.lea 130.133.1.10  2  u    16h  64        0 44.178   59.819  0.000

    My Windows Domain controllers also will not sync with an external time server in a timely fashion as it had before.  Performing a w32tm /resync returns "The computer did not resync because no time data was available."  But, as with the ESX host, it does get a response periodically.

    It's almost as if the return time data is passed along intermittently.  One thing I've thought of, and before I move to look into this, I'd like to pose this question:  I'm running ESX on a 4-core single-socket CPU.  Understanding that NTP is UDP,  How sensitive are XG virtual appliances to higher load averages with respect to UDP traffic?  If the LA is high (2-3 on single vCPU), will the firewall appliance drop packets in favor of TCP traffic?  Would I expect to see these drops anywhere in a log, or are they just silently dropped?

    SFVH_VM01_SFOS 17.5.7 MR-7# uptime
    08:20:54 up 3 days, 20:56, load average: 3.30, 2.90, 2.79

    CPU usage is around 10-20% on average.

Children
No Data
Unfiltered HTML