NTP sync failure(s)-fortinet-FortiOS
Vendor: fortinet
OS: FortiOS
Description:
Indeni will alert if one or more of the configured NTP servers is not syncing correctly.
Remediation Steps:
Review the cause for the NTP sync not working.
|1. Login via ssh to the Fortinet firewall and execute the FortiOS “execute time” and “execute date” commands to check the current date/time and the last date of NTP sync.
|2. Login via ssh to the Fortinet firewall and execute the FortiOS “diagnose sys ntp status” to review the status of the NTP servers and configuration.
|3. NTP uses UDP protocol (17) and port 123 to communicate between the client and the servers. Make sure that the firewall rules allow these UDP ports and can route toward the NTP servers.
|4. Login via ssh to the Fortinet firewall and execute the FortiOS debug commands “diag debug application ntpd -1” and “diag debug enable” and review the debug messages.
|5. Make sure NTP authentication keys match on both ends. Review the next link for more information http://kb.fortinet.com/kb/viewContent.do?externalId=FD33783.
|6. More NTP configuration information can be found at link http://help.fortinet.com/cli/fos50hlp/56/Content/FortiOS/fortiOS-cli-ref-56/config/system/ntp.htm.
How does this work?
This script logs into the FortiGate using SSH and retrieves the NTP servers readhabilty status information using the output of the “diagnose sys ntp status” command. The output includes the device’s server reachability status as well as information about the NTP configured parameters.
Why is this important?
This metric shows if the NTP servers used by the FortiGate are reachable. NTP servers are used to sync the time across all hosts and network devices. This is critical for things such as event correlation and logging. Use Network Time Protocol (NTP) to set the date and time if possible. However, it is important to ensure the NTP UDP port is allowed through the firewalls on your network. FortiToken synchronization requires NTP in many situations. Check the link below for more information about NTP config in FortiOS: http://kb.fortinet.com/kb/documentLink.do?externalID=FD40266
Without Indeni how would you find this?
An administrator would need to log into the device and use the “diagnose sys ntp status” command to identify if the NTP servers are reachable from the device.
fortios-diagnose-sys-ntp-status
name: fortios-diagnose-sys-ntp-status
description: FortiGate Diagnose ntp status
type: monitoring
monitoring_interval: 20 minutes
requires:
vendor: fortinet
os.name: FortiOS
product: firewall
comments:
ntp-is-synchronized:
why: |
It checks if the device is sync via NTP. NTP servers are used to sync the time across all hosts and network
devices. This is critical for things such as event correlation and logging. Use Network Time Protocol (NTP) to
set the date and time if possible. However, it is important to ensure the NTP UDP port is allowed through the
firewalls on your network. FortiToken synchronization requires NTP in many situations. Check the link below for
more information about NTP config in FortiOS:
http://kb.fortinet.com/kb/documentLink.do?externalID=FD40266
how: |
This script logs into the FortiGate using SSH and retrieves the NTP sync status information using the output of
the "diagnose sys ntp status" command. The output includes the device's ntp sync status as well as information
about all the NTP configured parameters.
can-with-snmp: false
can-with-syslog: false
ntp-sync-is-enabled:
why: |
This metric monitors if the use of NTP is enabled. NTP servers are used to sync the time across all hosts and
network devices. This is critical for things such as event correlation and logging. Use Network Time Protocol
(NTP) to set the date and time if possible. However, it is important to ensure the NTP UDP port is allowed
through the firewalls on your network. FortiToken synchronization requires NTP in many situations. Check the
link below for more information about NTP config in FortiOS:
http://kb.fortinet.com/kb/documentLink.do?externalID=FD40266
how: |
This script logs into the FortiGate using SSH and retrieves the NTP sync status information using the output of
the "diagnose sys ntp status" command. The output includes the device's ntp sync status as well as information
about the NTP configured parameters.
can-with-snmp: false
can-with-syslog: false
ntp-server-mode:
why: |
This metric shows if the device is used as NTP server. This is applicable starting with FortiOS 5.0. NTP
servers are used to sync the time across all hosts and network devices. This is critical for things such as
event correlation and logging. Use Network Time Protocol (NTP) to set the date and time if possible. However,
it is important to ensure the NTP UDP port is allowed through the firewalls on your network. FortiToken
synchronization requires NTP in many situations. Check the link below for more information about NTP config in
FortiOS: http://kb.fortinet.com/kb/documentLink.do?externalID=FD40266
how: |
This script logs into the FortiGate using SSH and retrieves the NTP server status information using the output
of the "diagnose sys ntp status" command. The output includes the device's server status as well as information
about the NTP configured parameters.
can-with-snmp: false
can-with-syslog: false
ntp-server-state:
why: |
This metric shows if the NTP servers used by the FortiGate are reachable. NTP servers are used to sync the
time across all hosts and network devices. This is critical for things such as event correlation and logging.
Use Network Time Protocol (NTP) to set the date and time if possible. However, it is important to ensure the
NTP UDP port is allowed through the firewalls on your network. FortiToken synchronization requires NTP in many
situations. Check the link below for more information about NTP config in FortiOS:
http://kb.fortinet.com/kb/documentLink.do?externalID=FD40266
how: |
This script logs into the FortiGate using SSH and retrieves the NTP servers readhabilty status information
using the output of the "diagnose sys ntp status" command. The output includes the device's server reachability
status as well as information about the NTP configured parameters.
can-with-snmp: false
can-with-syslog: false
ntp-servers:
why: |
This metric shows if at least a NTP server is configured. NTP servers are used to sync the time across all
hosts and network devices. This is critical for things such as event correlation and logging. Use Network Time
Protocol (NTP) to set the date and time if possible. However, it is important to ensure the NTP UDP port is
allowed through the firewalls on your network. FortiToken synchronization requires NTP in many situations.
Check the link below for more information about NTP config in FortiOS:
http://kb.fortinet.com/kb/documentLink.do?externalID=FD40266
how: |
This script logs into the FortiGate using SSH and retrieves the NTP servers configuration status information
using the output of the "diagnose sys ntp status" command. The output includes the device's servers
configuration status as well as information about the NTP configured parameters.
can-with-snmp: false
can-with-syslog: false
steps:
- run:
type: SSH
command: diagnose sys ntp status
parse:
type: AWK
file: diagnose_sys_ntp_status.parser.1.awk
all_devices_ntp_not_syncing
Failed to fetch the data: https://bitbucket.org/indeni/indeni-knowledge/src/master/rules/templatebased/crossvendor/all_devices_ntp_not_syncing.scala