Problem NTP Status: Clock is unsynchronized

[Adil.Balghzal]

Hi,

I can't synchronized my FW ASA 5525 with any NTP Servers (NTP V4.x), when i debug i got this showing :

XXXXXXXXX# show ntp status
Clock is unsynchronized, stratum 16, no reference clock
nominal freq is 99.9984 Hz, actual freq is 99.9984 Hz, precision is 2**6
reference time is 00000000.00000000 (07:28:16.000 UTC Thu Feb 7 2036)
clock offset is 0.0000 msec, root delay is 0.00 msec
root dispersion is 0.00 msec, peer dispersion is 0.00 msec
XXXXXXXXXX#

XXXXXXXXXX# show ntp associations
address ref clock st when poll reach delay offset disp
~10.10.10.2 .LOCL. 1 351 1024 377 0.7 -96782 112.1
~10.10.10.3 10.10.10.2 2 35 64 37 1.0 -96815 898.3
* master (synced), # master (unsynced), + selected, - candidate, ~ configured

XXXXXXXXXX#

XXXXXXXXXX# show ntp associations detail

10.10.10.2 configured, insane, invalid, stratum 1
ref ID .LOCL., time de886ac6.1a7834c5 (15:23:02.103 UTC Mon Apr 23 2018)
our mode client, peer mode server, our poll intvl 1024, peer poll intvl 1024
root delay 0.00 msec, root disp 10104.34, reach 377, sync dist 10220.612
delay 0.72 msec, offset -96782.6535 msec, dispersion 112.08
precision 2**6, version 3
org time de8888b8.365fa150 (17:30:48.212 UTC Mon Apr 23 2018)
rcv time de888918.fed39840 (17:32:24.995 UTC Mon Apr 23 2018)
xmt time de888918.fea39ea8 (17:32:24.994 UTC Mon Apr 23 2018)
filtdelay = 0.72 0.67 0.75 0.78 0.67 0.73 0.76 0.76
filtoffset = -96782. -96737. -96677. -96632. -96571. -96527. -96466. -96421.
filterror = 15.63 31.25 46.88 62.50 78.13 93.75 109.38 125.00

10.10.10.3 configured, insane, invalid, stratum 2
ref ID 10.10.10.2, time de8885eb.adbad701 (17:18:51.678 UTC Mon Apr 23 2018)
our mode client, peer mode server, our poll intvl 64, peer poll intvl 64
root delay 31.25 msec, root disp 10169.59, reach 17, sync dist 12091.492
delay 0.96 msec, offset -96816.5251 msec, dispersion 1905.81
precision 2**6, version 3
org time de8889b4.2dbad701 (17:35:00.178 UTC Mon Apr 23 2018)
rcv time de888a14.fee22d44 (17:36:36.995 UTC Mon Apr 23 2018)
xmt time de888a14.fea3130e (17:36:36.994 UTC Mon Apr 23 2018)
filtdelay = 0.96 0.90 1.04 1.04 0.00 0.00 0.00 0.00
filtoffset = -96816. -96799. -96798. -96797. 0.00 0.00 0.00 0.00
filterror = 15.63 16.60 17.58 18.55 16000.0 16000.0 16000.0 16000.0
XXXXXXXXXX#

XXXXXXXXXX# debug ntp packets
XXXXXXXXXX#
XXXXXXXXXX# NTP: xmit packet to 10.10.10.3:
leap 3, mode 3, version 3, stratum 0, ppoll 64
rtdel 0000 (0.000), rtdsp 10400 (1015.625), refid 00000000 (0.0.0.0)
ref 00000000.00000000 (07:28:16.000 UTC Thu Feb 7 2036)
org de8888f4.3292b071 (17:31:48.197 UTC Mon Apr 23 2018)
rec de888954.fee79178 (17:33:24.995 UTC Mon Apr 23 2018)
xmt de888994.fea37202 (17:34:28.994 UTC Mon Apr 23 2018)
NTP: rcv packet from 10.10.10.3 to 10.20.10.13 on Service:
leap 0, mode 4, version 3, stratum 2, ppoll 64
rtdel 0800 (31.250), rtdsp a2b09 (10168.106), refid 0a781e02 (10.10.10.2)
ref de8885eb.ae768c4e (17:18:51.681 UTC Mon Apr 23 2018)
org de888994.fea37202 (17:34:28.994 UTC Mon Apr 23 2018)
rec de888934.324d968b (17:32:52.196 UTC Mon Apr 23 2018)
xmt de888934.324d968b (17:32:52.196 UTC Mon Apr 23 2018)
inp de888994.fee78396 (17:34:28.995 UTC Mon Apr 23 2018)
NTP: peer->hmode = 3, hismode = 4. calling process_packet...

XXXXXXXXXX#

XXXXXXXXXX# debug ntp select NTP: nlist 0, allow 0, found 0, low 0.000000, high 0.000000
NTP: no select intersection
NTP: synchronization lost

XXXXXXXXXX#debug ntp events

XXXXXXXXXX#(no result)

XXXXXXXXXX# debug ntp validity

XXXXXXXXXX#(no result)

any idea please about this issue ?

best regard

[Georg Pauwen]

Hello,

where are the 10.x.x.x addresses you have configured a NTP servers ?

Post the configuration of your ASA. Basically, you need IP reachability to the NTP servers from the interface that is the source. 

In this example:

clock timezone GMT 1
clock summer-time GMT date JAN 1 2018 0:00 Dec 31 2035 0:00

ntp server 216.239.35.0 source outside prefer

the Google NTP server is reached through the outside interface of your firewall...

[Adil.Balghzal]

The NTP servers is 10.10.10.2 and 10.10.10.3 (localy servers)

part of configuration ntp on ASA :

clock timezone CEST 1
clock summer-time CEST 1 recurring las Sun Mar 2:00 last Sun Oct 3:00
ntp server 10.10.10.3 source outside prefer
ntp server 10.10.10.2 source outside

The local NTP servers is synch with Google NTP server

Thks

[Georg Pauwen]

Hello,

can you ping the 10.10.10.2 and 10.10.10.3 with the outside interface as the source ?

[Richard Burts]

The original poster says that the devices he has configured to provide ntp to the ASA are sync to Google. But the output says that is not the case

XXXXXXXXXX# show ntp associations
address ref clock st when poll reach delay offset disp
~10.10.10.2 .LOCL. 1 351 1024 377 0.7 -96782 112.1

that indication that the ref clock is .LOCL and the stratum is 1 indicates that this device is configured as ntp master (using its own time as the authoritative source).

In looking at the output look carefully at the reported dispersion. Values of dispersion this large prevent sync of ntp to this device.

10.10.10.2 configured, insane, invalid, stratum 1
ref ID .LOCL., time de886ac6.1a7834c5 (15:23:02.103 UTC Mon Apr 23 2018)
our mode client, peer mode server, our poll intvl 1024, peer poll intvl 1024
root delay 0.00 msec, root disp 10104.34, reach 377, sync dist 10220.612

HTH

Rick

[johnd2310]

Hi,

What are you NTP servers syncing to? Is the time on your NTP servers correct?

Thanks

John

[Adil.Balghzal]

the NTP servers is sync with Google NTP server and yes the time is correcte on NTP servers
Thks