Time synchronisation#

You will end up with a router whose clock is right and which answers NTP for the clients you meant it to. Time is load-bearing here in three specific ways, which is why this has a page: certificate validity, TOTP codes, and every timestamp in the audit log and the commit history.

Before you start#

The operator role and a licence, or console access.
Know what you have. The default configuration synchronises against pool.ntp.org and answers NTP queries from loopback, link-local and the RFC 1918 ranges. It does not answer the WAN.

bash

show configuration commands | match 'service ntp'

Step 1 — Choose servers#

In the UI: System → Settings → Time synchronisation.

As commands:

set service ntp server time.example.com
set service ntp server time.example.com pool
set service ntp server time.example.com prefer
set service ntp server time.example.com nts

pool marks the name as a pool rather than one host, prefer weights it, and nts asks for Network Time Security. The editor stages a bare set for the server plus one line per option you tick.

Remove one:

delete service ntp server pool.ntp.org

Step 2 — Decide who may ask#

set service ntp allow-client address 192.0.2.0/24

The allowed-client list is what makes the router an NTP server for your network rather than for the internet. Keep it to the prefixes you serve.

Step 3 — Point the LAN at the router#

If you hand out addresses with DHCP, the router can hand out itself as the NTP server:

set service dhcp-server shared-network-name LAN subnet 192.0.2.0/24 option ntp-server 192.0.2.1

See Give a device the same address every time for where that subtree lives.

Set the time zone while you are here#

set system time-zone Europe/Berlin

Also on System → Settings, under Identity. The audit log and the journal are stamped in the router's local time, so a wrong zone makes every timeline confusing.

Check it worked#

In the UI: Diagnostics → Time shows the configured servers, the router's clock and its synchronisation sources side by side.

From the API:

bash

R=https://<router>:8443
T=wh_...
curl -sk -H "Authorization: Bearer $T" "$R/api/ntp"

From a client on the LAN:

bash

ntpdate -q 192.0.2.1

The check that matters is not "is a server configured" but "is the clock right and is it staying right". A router that has never synchronised will happily list four servers.

What a wrong clock breaks#

Symptom	Because
Certificates rejected, or ACME issuance failing	Validity windows are absolute times. Issue a certificate.
TOTP codes always wrong	A time-based one-time password is time-based. Enrol a second factor.
The audit log and the commit history disagree with reality	Both are stamped from the router's clock.
A licence that should be valid reporting as expired	Expiry and grace are compared against the router's clock.

Undoing it#

delete service ntp server time.example.com
delete service ntp allow-client address 192.0.2.0/24

Removing every server leaves the router with a free-running clock, which is almost never what you want.

Time synchronisation#

Before you start#

Step 1 — Choose servers#

Step 2 — Decide who may ask#

Step 3 — Point the LAN at the router#

Set the time zone while you are here#

Check it worked#

What a wrong clock breaks#

Undoing it#

See also#