Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NTP Peer Availability

    Scheduled Pinned Locked Moved General pfSense Questions
    15 Posts 3 Posters 1.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • provelsP
      provels
      last edited by

      Good morning! Very often I log into my FW and find the NTP Status widget showing this:
      30945e0e-74a6-48a8-86f7-6480adc709fb-image.png
      My pool is 2.us.pool.ntp.org. The FW is a Hyper-V VM, but time sync from the host is disabled. It seems the time gets off sync and it screws up my RRD Summary data, but that's minor; I can track my usage at the ISP level. Any thoughts? Thanks for reading an any replies.

      Peder

      MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
      BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        Does it still show the full list of peers in the main NTP status page? Just non active?

        Are they marked as invalid because the time difference is too large?

        Sounds like a virtualisation issue somewhere.

        Steve

        provelsP 1 Reply Last reply Reply Quote 0
        • provelsP
          provels @stephenw10
          last edited by

          @stephenw10
          Just shows this:
          4d393942-4c45-4015-9f90-26359ffaf2a8-image.png
          Bouncing NTP populates the list:
          579b8d54-85eb-400a-b42b-26a384277d1a-image.png
          Sometimes when I login to the Dashboard, it's fine, other times broken. Not consistent, but yes, may well be a VM thing.

          Peder

          MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
          BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

          1 Reply Last reply Reply Quote 0
          • B
            bartkowski
            last edited by

            I noticed the same thing on my 2440. As I write this, I see "No active peers available". I'm using pool.ntp.org

            ntp.png

            1 Reply Last reply Reply Quote 0
            • provelsP
              provels
              last edited by provels

              Maybe it something that happens on reboot. NTP unable to resolve the pool, then never checks back? NTP starting before DNS? Just spitballing.

              EDIT - OK, so I restarted the FW @ 10:10 AM.

              Resolver starts.
              NTPD starts.
              PFB starts.

              PFB finishes last.

              NTP shows no peers.

              Maybe DNS N/A until PFB completes? ¯\(ツ)/¯

              Will monitor and see if the peers list populates w/o bouncing the NTP service.

              Peder

              MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
              BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

              1 Reply Last reply Reply Quote 0
              • provelsP
                provels
                last edited by provels

                OK, after 70 minutes after reboot, still no peers listed.

                @bartkowski it would be interesting if you could try duplicating this behavior on a physical box.

                Peder

                MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
                BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

                B 1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  NTP will only sync when it has sufficient data to do so. That number of servers agreeing and showing sufficient reach. It takes time to build up the reach value, it won't sync to those at 0 or 3.
                  They should all be showing 377 eventually if they are good time sources.

                  Steve

                  provelsP 1 Reply Last reply Reply Quote 0
                  • provelsP
                    provels @stephenw10
                    last edited by

                    @stephenw10
                    Any idea what kind of time interval this could require?

                    PS - See my previous post on reboot behavior.

                    Peder

                    MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
                    BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

                    1 Reply Last reply Reply Quote 0
                    • B
                      bartkowski @provels
                      last edited by

                      @provels I'm using Netgate SG-2440

                      provelsP 1 Reply Last reply Reply Quote 0
                      • provelsP
                        provels @bartkowski
                        last edited by

                        @bartkowski
                        That's what I mean. Mine runs virtual, yours physical. That could help determine if it's something triggered somehow by only the virtual environment.

                        Peder

                        MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
                        BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

                        1 Reply Last reply Reply Quote 0
                        • provelsP
                          provels
                          last edited by provels

                          OK, after 2 hours 20 minutes, still no NTP pool servers listed "No Active Peers".
                          Restarted NTP, widget status "Updating...".
                          A few minutes later, "No Active Peers"... ¯\(ツ)/¯

                          Peder

                          MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
                          BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            Hmm, two different issues here. If the list never populates from the pool I would be looking for a DNS issue or something else that might stop it pulling the list.

                            If it populates but no ntp servers ever show as active that's something else.

                            Steve

                            provelsP 1 Reply Last reply Reply Quote 0
                            • provelsP
                              provels @stephenw10
                              last edited by

                              @stephenw10
                              Checked back after 10 minutes, now NTP Status was populated, widget shows a sync source. Just something to monitor after reboots I guess.

                              Peder

                              MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
                              BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                Yeah, 5-10mins is not unusual for the reach value to get to what ntp will accept.
                                http://www.ntp.org/ntpfaq/NTP-s-trouble.htm#Q-MON-REACH

                                Steve

                                provelsP 1 Reply Last reply Reply Quote 0
                                • provelsP
                                  provels @stephenw10
                                  last edited by

                                  @stephenw10
                                  Thanks for the link. Yeah, but i think there may be a DNS problem, since nothing showed for over 2 hours after boot. Will pursue.

                                  Peder

                                  MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
                                  BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.