I cannot sync with a NTP source thats coming from an internal router/firewall.
Anyone help ?
ntppdate -d 192.168.92.82
6 Jun 11:57:30 ntpdate[5011]: ntpdate [email protected] Tue Feb 24 06:32:26 EST 2004 (1)
transmit(192.168.92.82)
receive(192.168.92.82)
transmit(192.168.92.82)
receive(192.168.92.82)
transmit(192.168.92.82)
receive(192.168.92.82)
transmit(192.168.92.82)
receive(192.168.92.82)
transmit(192.168.92.82)
192.168.92.82: Server dropped: strata too high
server 192.168.92.82, port 123
stratum 16, precision -19, leap 11, trust 000
refid [73.78.73.84], delay 0.02591, dispersion 0.00002
transmitted 4, in filter 4
reference time: 00000000.00000000 Thu, Feb 7 2036 6:28:16.000
originate timestamp: d1972e03.0ae02645 Mon, Jun 6 2011 11:44:19.042
transmit timestamp: d197311b.0ffac1d2 Mon, Jun 6 2011 11:57:31.062
filter delay: 0.02609 0.02591 0.02594 0.02596
0.00000 0.00000 0.00000 0.00000
filter offset: -792.020 -792.020 -792.020 -792.020
0.000000 0.000000 0.000000 0.000000
delay 0.02591, dispersion 0.00002
offset -792.020152
6 Jun 11:57:31 ntpdate[5011]: no server suitable for synchronization found
Edit
The server I'm being asked to sync to is a firewall , and I've now been told that it is not syncing with anything. So I suppose I need to know if I can force my server to sync with a server that is stratum 16 i.e not sync'd. Is that possible ?
I have found that attempting to change the stratum of a server in the client side ntp.conf with a
does not work.
However, if you can access the ntp.conf on the server (the machine running ntpd) and add the following lines
it is able to fudge itself (127.127.1.0 is the local ntpd server address, 8 is a number less than 16) (remember to restart ntpd).
You can then successfully run ntpdate on the client (
ntpdate <server_ip>
).NTP increases the stratum for each level in the hierarchy - a NTP server pulling time from a "stratum 1" server would advertise itself as "stratum 2" to its clients.
A stratum value of "16" is reserved for unsynchronized servers meaning that your internal NTP server at 192.168.92.82 thinks not to have a reliable timesource (i.e. not synchronizing to a higher-level stratum server).
You would need to do some debugging there - if it is a Linux server using ntpd, look at the output of
ntpq peers
for clues for possible reasonsWell, the error message does say it quite clearly: "stratum too high". In essence your ntpdate is telling you that your time server is too far down the hierarchy to be reliable. There is a line the printout that shows it:
I have no idea how you got there, but a stratum 16 time server is 15 levels removed from the stratum 1 servers, and that is a lot. You might want to try and find out why that is the case. In our company network, most machines synchronize to the linux gateways, which are connected to stratum 3 servers (which makes them stratum 4) or the domain controllers (same). You'd have to have a really complicated network setup to reach stratum 16.
Try running
ntpdate tock.usno.navy.mil
That is a stratum 1 NTP server ran by the US Naval Observitory. See if you can sync to that, then move forward from that. By any chance is your firewall / router a PFsense box running OpenNTPD?You can add the
-d
if you like.There may be a line which starts with restrict default just delete it and restart the service... now run ntpq and then pe
here is my before and after...
and the result is ....
now when i comment out that line... (or ANY line that may start with restrict default).. I get...
And THAT was the solution to MY problem !!!