Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 10 replies
  • Answers 3 answers
  • Subscribers 30 subscribers
  • Views 8936 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

LAN Clients unable to receive External NTP Server Time

Brad Peter

Hello,

Recently moved from UTM to XG and I'm encountering an issue where my LAN clients are unable to receive NTP replied from NTP servers.  I did not have this issue in UTM.

My general rule setup is to allow any LAN client unrestricted access to the internet.  When viewing the logs, port 123 traffic is allowed outbound, but does not appear that any client is recieiving the reply.  I have no other known issues connecting to the internet for any other services.  The Sophos XG appliance is able to get accurate time from NTP servers.

Are there any configurations I should be making to allow NTP for the LAN clients?

Thanks!

Brad



This thread was automatically locked due to age.
Parents
  • 0

    First, thanks to those who took the time to reply.  I ultimately ended up taking a little hiatus on this issue.  I've just been keeping up with the time sort of manually.  Decided to pick this up again.

    I dug around a bit today and it seems that when the NTP request is sent out by a LAN client, for the most part its source port is 123.  I don't think that the XG firewall is correctly assigning a random port for the NAT, therefore when the FW receives the return packet, it doesn't know where to send the reply (perhaps I misunderstand how this is supposed to work, and if I do, please advise).

    For those requests sent with port 123 I don't seem to get a reply on the client device.  Occasionally, some of those packets are sent with a random high port and those requests I do get a reply on the client.

    Understand this is all observational, but I wonder if this has some merit?  I'm not sure how to validate this.  Guidance would be suggested.

    These hits were when I ran w32tm /resync on my Domain controller, which errored out with:

    C:\Users\Administrator>w32tm /resync
    Sending resync command to local computer
    The computer did not resync because no time data was available.

    Firewall
    2019-09-24 23:45:56
    Firewall Rule
    Allowed
    7
    		  
    00001
    1
    10.10.10.1
    123
    LAN
    174.136.103.130
    123
    WAN
    PortA
    PortB
    UDP
    		  
    Firewall
    2019-09-24 23:45:56
    Firewall Rule
    Allowed
    7
    		  
    00001
    1
    10.10.10.1
    123
    LAN
    184.105.182.16
    123
    WAN
    PortA
    PortB
    UDP
    		  
    Firewall
    2019-09-24 23:45:56
    Firewall Rule
    Allowed
    7
    		  
    00001
    1
    10.10.10.1
    123
    LAN
    198.255.68.106
    123
    WAN
    PortA
    PortB
    UDP
    		  
    Firewall
    2019-09-24 23:45:56
    Firewall Rule
    Allowed
    7
    		  
    00001
    1
    10.10.10.1
    123
    LAN
    173.255.215.209
    123
    WAN
    PortA
    PortB
    UDP
    		  
    Firewall
    2019-09-24 23:45:56
    Firewall Rule
    Allowed
    7
    		  
    00001
    1
    10.10.10.1
    123
    LAN
    216.229.0.49
    123
    WAN
    PortA
    PortB
    UDP
    		  
    Firewall
    2019-09-24 23:45:56
    Firewall Rule
    Allowed
    7
    		  
    00001
    1
    10.10.10.1
    123
    LAN
    66.228.48.38
    123
    WAN
    PortA
    PortB
    UDP
    		  
    Firewall
    2019-09-24 23:45:56
    Firewall Rule
    Allowed
    7
    		  
    00001
    1
    10.10.10.1
    123
    LAN
    50.76.34.188
    123
    WAN
    PortA
    PortB
    UDP
    		  
    Firewall
    2019-09-24 23:45:56
    Firewall Rule
    Allowed
    7
    		  
    00001
    1
    10.10.10.1
    123
    LAN
    198.60.22.240
    123
    WAN
    PortA
    PortB
    UDP

    I then run:

    C:\Users\Administrator>w32tm /stripchart /dataonly /computer:0.us.pool.ntp.org
    Tracking 0.us.pool.ntp.org [23.239.24.67:123].
    The current time is 9/24/2019 11:48:58 PM.
    23:48:58, -62.3465844s
    23:49:00, -62.3321461s
    23:49:02, -62.3591517s
    23:49:04, -62.3593514s

    And this is the result in the log:

    Firewall
    2019-09-24 23:48:31
    Firewall Rule
    Allowed
    7
    		  
    00001
    1
    10.10.10.1
    52418
    LAN
    23.239.24.67
    123
    WAN
    PortA
    PortB
    UDP
    		  
    Firewall
    2019-09-24 23:48:29
    Firewall Rule
    Allowed
    7
    		  
    00001
    1
    10.10.10.1
    52417
    LAN
    23.239.24.67
    123
    WAN
    PortA
    PortB
    UDP
    		  
    Firewall
    2019-09-24 23:48:27
    Firewall Rule
    Allowed
    7
    		  
    00001
    1
    10.10.10.1
    52416
    LAN
    23.239.24.67
    123
    WAN
    PortA
    PortB
    UDP

    Notice the source ports are now "random" high ports and I received time data back.

Reply
  • 0

    First, thanks to those who took the time to reply.  I ultimately ended up taking a little hiatus on this issue.  I've just been keeping up with the time sort of manually.  Decided to pick this up again.

    I dug around a bit today and it seems that when the NTP request is sent out by a LAN client, for the most part its source port is 123.  I don't think that the XG firewall is correctly assigning a random port for the NAT, therefore when the FW receives the return packet, it doesn't know where to send the reply (perhaps I misunderstand how this is supposed to work, and if I do, please advise).

    For those requests sent with port 123 I don't seem to get a reply on the client device.  Occasionally, some of those packets are sent with a random high port and those requests I do get a reply on the client.

    Understand this is all observational, but I wonder if this has some merit?  I'm not sure how to validate this.  Guidance would be suggested.

    These hits were when I ran w32tm /resync on my Domain controller, which errored out with:

    C:\Users\Administrator>w32tm /resync
    Sending resync command to local computer
    The computer did not resync because no time data was available.

    Firewall
    2019-09-24 23:45:56
    Firewall Rule
    Allowed
    7
    		  
    00001
    1
    10.10.10.1
    123
    LAN
    174.136.103.130
    123
    WAN
    PortA
    PortB
    UDP
    		  
    Firewall
    2019-09-24 23:45:56
    Firewall Rule
    Allowed
    7
    		  
    00001
    1
    10.10.10.1
    123
    LAN
    184.105.182.16
    123
    WAN
    PortA
    PortB
    UDP
    		  
    Firewall
    2019-09-24 23:45:56
    Firewall Rule
    Allowed
    7
    		  
    00001
    1
    10.10.10.1
    123
    LAN
    198.255.68.106
    123
    WAN
    PortA
    PortB
    UDP
    		  
    Firewall
    2019-09-24 23:45:56
    Firewall Rule
    Allowed
    7
    		  
    00001
    1
    10.10.10.1
    123
    LAN
    173.255.215.209
    123
    WAN
    PortA
    PortB
    UDP
    		  
    Firewall
    2019-09-24 23:45:56
    Firewall Rule
    Allowed
    7
    		  
    00001
    1
    10.10.10.1
    123
    LAN
    216.229.0.49
    123
    WAN
    PortA
    PortB
    UDP
    		  
    Firewall
    2019-09-24 23:45:56
    Firewall Rule
    Allowed
    7
    		  
    00001
    1
    10.10.10.1
    123
    LAN
    66.228.48.38
    123
    WAN
    PortA
    PortB
    UDP
    		  
    Firewall
    2019-09-24 23:45:56
    Firewall Rule
    Allowed
    7
    		  
    00001
    1
    10.10.10.1
    123
    LAN
    50.76.34.188
    123
    WAN
    PortA
    PortB
    UDP
    		  
    Firewall
    2019-09-24 23:45:56
    Firewall Rule
    Allowed
    7
    		  
    00001
    1
    10.10.10.1
    123
    LAN
    198.60.22.240
    123
    WAN
    PortA
    PortB
    UDP

    I then run:

    C:\Users\Administrator>w32tm /stripchart /dataonly /computer:0.us.pool.ntp.org
    Tracking 0.us.pool.ntp.org [23.239.24.67:123].
    The current time is 9/24/2019 11:48:58 PM.
    23:48:58, -62.3465844s
    23:49:00, -62.3321461s
    23:49:02, -62.3591517s
    23:49:04, -62.3593514s

    And this is the result in the log:

    Firewall
    2019-09-24 23:48:31
    Firewall Rule
    Allowed
    7
    		  
    00001
    1
    10.10.10.1
    52418
    LAN
    23.239.24.67
    123
    WAN
    PortA
    PortB
    UDP
    		  
    Firewall
    2019-09-24 23:48:29
    Firewall Rule
    Allowed
    7
    		  
    00001
    1
    10.10.10.1
    52417
    LAN
    23.239.24.67
    123
    WAN
    PortA
    PortB
    UDP
    		  
    Firewall
    2019-09-24 23:48:27
    Firewall Rule
    Allowed
    7
    		  
    00001
    1
    10.10.10.1
    52416
    LAN
    23.239.24.67
    123
    WAN
    PortA
    PortB
    UDP

    Notice the source ports are now "random" high ports and I received time data back.

Children
No Data