topic Re: NTP sync to server 0.pool.ntp.org failed in General Topics

NTP sync to server 0.pool.ntp.org failed

philipp_scherer — Wed, 08 Apr 2020 12:22:12 GMT

Hello all,

we run an upgrade on our Panorama to 9.0.7.

Since a few days, I'm receiving this warning:

NTP sync to server SERVER failed, authentication type none

Same message for primary and secondary NTP server.

I switched from internal to external NTP server. Same error.

I already checked:

CLI NTP status command

user@PAN> show ntp NTP state: NTP not synched, using local clock NTP server: 0.pool.ntp.org status: rejected reachable: no authentication-type: none NTP server: 1.pool.ntp.org status: rejected reachable: no authentication-type: none

Firewall rules

Panorama is allowed to access external NTP servers.

VMware tools options

Time synchronization with host is disabled.

Reboot

I did a reboot, same error.

Known Issues

Checked the know issues https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-release-notes/pan-os-9-0-release-information/known-issues/known-issues-related-to-pan-os-9-0-releases.html#id1787F0E08SZ. I haven't found anything that matches.

Is somebody able to help?

Re: NTP sync to server 0.pool.ntp.org failed

kiwi — Wed, 08 Apr 2020 13:09:09 GMT

Hi @philipp_scherer ,

Sounds familiar. If possible, can you test with NTP server time.google.com and check if that works ?

Cheers,

-Kiwi.

Re: NTP sync to server 0.pool.ntp.org failed

philipp_scherer — Wed, 08 Apr 2020 13:17:39 GMT

Hello @kiwi,

thanks for your fast reply.

I tried, same result.

admin@PAN> debug software restart process ntp Process ntp was restarted by user admin admin@PAN> show ntp NTP state: NTP not synched, using local clock NTP server: time.google.com status: rejected reachable: no authentication-type: none NTP server: 1.pool.ntp.org status: rejected reachable: no authentication-type: none

I also verified in the firewall logs. Panorama was allowed to connect to time.google.com.

Re: NTP sync to server 0.pool.ntp.org failed

kiwi — Wed, 08 Apr 2020 13:30:07 GMT

Hi @philipp_scherer ,

Sorry if I didn't mention that in my previous comment. But could you remove the backup NTP. Just try the one 'time.google.com' without the backup.

Eitherway I'd reach out to support.

If time.google.com works when you remove the backup NTP then you're likely hitting an existing bug.

If it still doesn't work then further debugging will be required.

Cheers,

-Kiwi.

Re: NTP sync to server 0.pool.ntp.org failed

philipp_scherer — Wed, 08 Apr 2020 18:06:04 GMT

Hello @kiwi

thanks for your hint!

I forgot to mention I already tried this with internal and external NTP servers. 😞

Regards,

Philipp

Re: NTP sync to server 0.pool.ntp.org failed

Zakareya — Sun, 17 May 2020 13:12:28 GMT

I think it is a bug since i have the exact issue, i was using software version 8.1.8 and it was working fine, but i have upgraded to version 9.0.7 then i start receiving the following error "SYSTEM ALERT : medium : NTP sync to server 192.168.103.22 failed, authenticati...", case already opened but still not been fixed 😞

Re: NTP sync to server 0.pool.ntp.org failed

SutareMayur — Sun, 17 May 2020 16:54:45 GMT

@philipp_scherer,

I have also recently upgraded my Panorama Server and a pair of HA clusters to 9.0.7 version. I have also faced same issue on each instance.

I was also using public ntp server "time.google.com".

I tried by configuring internal NTP as well but still no luck. Then i just configured NTP IP address instead of it's FQDN. Post commit, NTP status is showing as "synched". I am also suspecting this as a kind of bug. You can give a try by configuring NTP IP address and check if it works for you.

Meanwhile i am also raising support case for this issue.

Mayur

Re: NTP sync to server 0.pool.ntp.org failed

SutareMayur — Mon, 18 May 2020 07:40:15 GMT

Hello,

I got reply from TAC on this issue. Engineer is saying this is known issue (PAN-133179) and it is addressed in PAN-OS 9.1.2.

He also confirmed that workaround for this issue is the same that i mentioned in my earlier post. Use IP address of NTP instead of FQDN.

Not sure why this was not mentioned in known issue list/release notes for 9.0.7.

Mayur

Re: NTP sync to server 0.pool.ntp.org failed

Zakareya — Mon, 18 May 2020 07:58:49 GMT

But in my case i'm already using IP address not FQDN

Re: NTP sync to server 0.pool.ntp.org failed

SutareMayur — Mon, 18 May 2020 08:12:32 GMT

@Zakareya,

Are you using Private internal NTP or public NTP server? I would suggest to try using internal NTP server IP address.

Today also i have upgraded one more HA cluster to 9.0.7 version and i replaced public NTP FQDN with IP address of internal NTP server, and it is showing synced status.

Mayur

Re: NTP sync to server 0.pool.ntp.org failed

Zakareya — Mon, 18 May 2020 08:56:06 GMT

@SutareMayur

Yeah i'm using Internal NTP server which it was on the previous software version 8.1.8 before the upgrade and it is IP not FQDN,

@PA-5220-Primary(active)> show ntp

NTP state:
NTP not synched, using local clock
NTP server: 10.1.130.12
status: rejected
reachable: yes
authentication-type: none

Re: NTP sync to server 0.pool.ntp.org failed

SutareMayur — Mon, 18 May 2020 12:04:51 GMT

@Zakareya,

Have you configured any service route for NTP service?

Mayur

Re: NTP sync to server 0.pool.ntp.org failed

Zakareya — Mon, 18 May 2020 15:00:22 GMT

Hi,

Yeah i tried with the default and with it vlan but at the end i'm using the MNGT Interface

Re: NTP sync to server 0.pool.ntp.org failed

BK0007 — Wed, 20 May 2020 04:12:38 GMT

Is this workaround working for all? We are also planning to upgrade to 9.0.7 and we have public NTP FQDN configured. I want to take all precautions before upgrade.

Re: NTP sync to server 0.pool.ntp.org failed

Zakareya — Wed, 20 May 2020 07:08:15 GMT

@SutareMayur

Hi,

My issue fixed by using the below command to restart the NTP service/process

debug software restart process ntp

Thanks Hamid Safarzadeh & Michel from Westcon and sure @SutareMayur

Re: NTP sync to server 0.pool.ntp.org failed

Zakareya — Wed, 20 May 2020 07:15:42 GMT

@BK0007

as i know version 9.0.7 is the latest stable version under 9.0 and i don't have any issue with BUT keep in mind that my NTP is an IP not FQDN