topic Re: How to configure pool.ntp.org or us.pool.ntp.org as ntp server in Next-Generation Firewall Discussions

How to configure pool.ntp.org or us.pool.ntp.org as ntp server

ciscojuniperf5 — Wed, 17 Sep 2025 11:47:48 GMT

I configured them both using fqdn on the security policy with source as firewall management interface but ntp status shows rejected. How do I fix this. Please help

All services to the internet use management interface

DNS configured 1.1.1.1 and 8.8.8.8

Firewall can ping 1.1.1.1 and 8.8.8.8

Allowed application ntp and ntp base

I checked the monitor tab I see two times a traffic has hit the rule and firewall has allowed the traffic and rest all it has denied. My theory is that the IP address of pool.ntp.org keeps changing everytime so if firewall does not have the IP address in its DNS cache, it would drop the traffic, please advise if I am wrong

Re: How to configure pool.ntp.org or us.pool.ntp.org as ntp server

reaper — Fri, 19 Sep 2025 12:04:19 GMT

it indeed looks like you keep getting 4 random IP addresses each time you resolve the FQDN

- stick to 2 of the IPs you receive and put those in your NTP config

- pick a different NTP with more predictable IP addresses

- allow all outbound NTP from your management interface

- run an internal NTP server

Re: How to configure pool.ntp.org or us.pool.ntp.org as ntp server

f.kuecuek — Mon, 22 Sep 2025 07:21:36 GMT

Hello,

Firstly, you cannot configure the management interface in a policy since it is not part of the data plane. Secondly, test connectivity by pinging pool.ntp.org from the firewall. From what you have explained, I think you need to check the routes after the management interface (on switch/router). Alternatively, you can perform a tcpdump on the management interface to see if packets are being sent or received.

https://docs.paloaltonetworks.com/ngfw/administration/monitoring/take-packet-captures/take-a-packet-capture-on-the-management-interface