Time synchronisation#

You will end up with a router whose clock is right and which answers time requests from the clients you meant it to. Three things depend on it: certificate validity, two-factor codes, and every timestamp in the audit log and the configuration history.

Before you start#

The Operator role, and a licence: time servers are part of the router's configuration.
Know what you have. System → Settings tab → Time synchronisation lists the time servers, with Pool, Preferred and NTS beside the ones that have them, and below them Serves time on and Allowed clients.

A router installed from the Wheelhouse image starts with three servers — 0.pool.ntp.org, 1.pool.ntp.org and 2.pool.ntp.org — and allows time clients from the router itself and the private and link-local ranges only: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, fc00::/7 and fe80::/10. Clients on the internet are not among them.

Step 1 — Choose servers#

Time synchronisation → Add time server.

Field	Takes
Server	A host name or an IP address. Anything else is refused with "Enter an IP address or a host name."; a server already listed with "time.example.com is already a time server."
Pool	"The name resolves to several servers." Turn it on for a pool name such as `pool.ntp.org`.
Preferred	Turn it on for the server the router should prefer over the others.
NTS	"Authenticated time. The server must support NTS."

Add time server adds "Add time server time.example.com" to the pending changes, with the options beneath it ("With NTS"). Apply it from the bar at the bottom of the page with Apply changes.

To change a server's options, click it. To remove it, click it and choose Delete time server.

Step 2 — Decide who may ask#

Time synchronisation → Edit time service: "The router can serve time to devices on its networks."

Field	Takes
Serve time on	"Addresses of this router that answer time requests."
Allowed clients	"Networks that may use this router as a time server." Each is an address with its prefix length, such as `192.0.2.0/24`.

Type a value and choose Add; the × beside a value removes it. Save changes adds the difference to the pending changes — "Allow time clients from 192.0.2.0/24" — and you apply it as in step 1.

The allowed-client list is what makes the router a time server for your networks rather than for the internet. Keep it to the networks you serve.

Step 3 — Point the LAN at the router#

A DHCP server can tell its clients to use the router as their time server, but the DHCP page does not set that option in this release. It is set at the router's console (Working from the console):

set service dhcp-server shared-network-name LAN subnet 192.0.2.0/24 option ntp-server 192.0.2.1

followed by commit and save. A device that does not take the option from DHCP needs the router's address in its own time settings.

Set the time zone while you are here#

System → Settings tab → General → Edit → Time zone offers every time zone the browser knows; the General panel shows UTC when none is set. The zone is the local time of the router's own logs and of a scheduled task's cron schedule. Save changes, then apply.

Check it worked#

In the web interface: Diagnostics → Time tab shows the configured servers and the synchronisation sources the router is actually using, and reads them again every 30 seconds.

From a client on the LAN:

bash

ntpdate -q 192.0.2.1

The check that matters is not "is a server configured" but "is the clock right and is it staying right". A router that has never synchronised still lists its servers.

What a wrong clock breaks#

Symptom	Because
Certificates rejected, or ACME issuance failing	Validity windows are absolute times. Issue a certificate.
Two-factor codes always wrong	The codes are computed from the time. Enrol a second factor.
The audit log and the configuration history disagree with reality	Both are stamped from the router's clock.
A licence that should be valid shown as expired, or as Clock not verified	Expiry and grace are compared against the router's clock, and a clock that reads earlier than the licence's issue date cannot judge expiry at all.

Undoing it#

Click a server and choose Delete time server; in Edit time service, the × beside an address or a network removes it. Apply from the bar.

Removing every server leaves the router with a free-running clock — the panel then says "No time servers" and "The router’s clock is not synchronised." — which is almost never what you want.

In Advanced mode#

With Advanced mode on (Account → Preferences), Review changes lists these changes as the router's commands: the time servers and the time service under service ntp, and the time zone under system time-zone.