Smoothwall NTP - Am I reading this right?

[Norphy]

So, the situation is that the clocks on our network are two minutes slow. This isn't causing any problems with the computers but the two kilos of grey matter inbetween our user's ears is causing issues.

 

Our domain controllers are all virtual, and the overall consensus of opinion is that virtual DCs should not be getting their time from their hosts. So instead, I've got them syncing against one of our Smoothwalls with the NTP Service enabled. However, this Smoothwall is two minutes slow which would explain why the clients are also two minutes slow.

 

I've read this article:

https://kb.smoothwall.com/hc/en-us/articles/360002967259-Setting-the-Network-Time-Protocol-NTP-Best-Practice

 

Which seems to imply to me that a Smoothwall can be an NTP Client or an NTP server but not both at the same time. Am I reading that right?

[TechMonkey]

I wouldn't agree with you. The final line

This setup keeps all NTP traffic internal on your network, only time updates and checks from the Smoothwall system talks to external addresses.

indicates to me that they expect you to use the Smoothwall box to provide the time internally and only the Smoothwall box to retrieve the time externally.

[ibpalle]

Yes, you are correct. The Smoothwall is either a time server or a time client. If you enable any of the interfaces for time service, the Smoothwall becomes a server retrieving time from stratum servers afaik. Select the multiple random servers option for time retrieval - and try the get time now button and see if that corrects the time.

[Norphy]

Yes, you are correct. The Smoothwall is either a time server or a time client. If you enable any of the interfaces for time service, the Smoothwall becomes a server retrieving time from stratum servers afaik. Select the multiple random servers option for time retrieval - and try the get time now button and see if that corrects the time.

 

Sorry @ibpalle, do you mean that I'm right or that Techmonkey is right?

 

Thanks

[ibpalle]

Yes - you are both right. Techmonkey just clarified the 'path' as such. Smoothwall provides the time service internal and retrieves the time externally - which is the case when Smoothwall is the time server.

 

If no interfaces have been selected, then Smoothwall just acts as a client, using whatever time server setting enabled in that section.

[TechMonkey]

I think that the confusion is, at least in my mind, "Smoothwall is either a time server or a time client" suggests that when Smoothwall is a time server it can not be a time client and pick the time up from elsewhere. I think it is the use of OR, making it sound like a one or the other, not both.

 

I'm pretty sure the KB wording has been updated as it seems clearer on there now.

[Joeloman]

Some of our customers use their own internal time servers, which then Smoothwall distributes to the Lan who need it.

GPS time server prevents the risk of someone spoofing the NTP domain or running NTP amplification DDoS attack on your firewall.

 

 

For example. like this:https://timemachinescorp.com/product/gps-time-server-tm1000a/