NTP through a VPN tunnel

[irbk]

I would like to setup sort of a single source of truth for time on the network.  Our WatchGuard box at HQ already has pool.ntp configured on it and our servers are then getting NTP data from the WatchGuard.  I'd like to also have the ASA 5525, who is on the other side of a VPN tunnel to the WatchGuard, using the WatchGuard as his NTP source.  I've configured the ASA with
ntp server <ip of WatchGuard> source <vlan with firewall rules allowing NTP through to the WatchGuard>
The vlan above has other servers that are able to get NTP from the WatchGuard without issue.  I'm guessing that the NTP packets from the ASA aren't really being sourced from the right interface or something?  Even though I've specified a source.

[balaji.bandi]

So the issue you see on ASA only ?

is the Same ASA doing VPN ?

[irbk]

Correct, the ASA is doing the VPN tunnel to the WatchGuard.  I'm wondering if the ASA can't send traffic through the tunnel when the source of the traffic is itself.  

[tvotna]

Yes, the command "ntp server <ip> source <int>" takes IP from the specified interface, but the request is still routed via the routing table and doesn't make it into VPN.

[irbk]

Shoot, any way to fix that?  

[balaji.bandi]

is the NTP destination IP part of Intersting traffic of Tunnel ?

check NTP can use over IPSEC  (personally i dont like to use NTP - prefer to have local)

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113421-asa83-ntp-config-00.html

[irbk]

Yes, the destination IP is part of interesting traffic to the tunnel. 
I've seen that article before I posted this question but didn't find it helpful, but thanks.

[balaji.bandi]

Try using interface internal in your case "corp"

[irbk]

Yeah the
ntp server <ip of WatchGuard> source <vlan with firewall rules allowing NTP through to the WatchGuard>
source as listed above is "corp"

[MHM Cisco World]

Use inside as source interface to connect to NTP

Use access management for inside 

And then check again 

MHM

[irbk]

I don't have "inside" as an actual configured interface however the interface that I used is an "inside" interface.  You think it might be a Management access rule issue?

[MHM Cisco World]

You use vpn s2s what is interface connect to LAN allow in vpn acl?

Use it as source for ntp.

[irbk]

Yes, that's what I'm doing.  Interface "corp" is one of many vlans which are "internal" and the source that I'm putting for the NTP command.  Same interface has an ACL allowing the corp/24 network to the WatchGuard on 123.

[MHM Cisco World]

Add 

Management-access corp

Then check ntp sync 

[irbk]

Sorry it took me so long to reply but I wanted to lab this up before giving it a try.  Adding the management-access cmd didn't change anything.  AAMOF in a packet capture I don't even see the ASA trying to send packets through the tunnel.