Configure system time and NTP on Sophos Firewall

Under Administration > Time, one configures the clock of Sophos Firewall itself. For a typical internet-connected firewall, the following is usually sufficient: select the appropriate Time zone, leave Use predefined NTP server enabled, click Sync now, save with Apply, and reload WebAdmin. Current time only shows the updated value after the page has been reloaded.

This setting does not automatically turn the firewall into an NTP server for internal devices. If clients must use the gateway IP address as their time server, Use Sophos Firewall as an NTP relay explains the separate NAT procedure.

⚠️ When the configured NTP servers are changed, all IPsec tunnels reconnect. A server change therefore belongs in a maintenance window. Sophos does not document this reconnect for Sync now alone when the server list remains unchanged.

Why system time and time zone matter separately

NTP synchronizes a common absolute time reference based on UTC. The Time zone determines how the firewall displays this time locally and when local schedules take effect. This can result in two different types of error:

• The actual time is incorrect: Certificates may appear not yet valid or expired, authentication and MFA may fail, and VPN connections may not establish.
• The time zone is incorrect: Synchronization may work technically, while log entries, reports, maintenance windows, or time-based rules appear shifted by one or more hours.

This distinction is important for troubleshooting. If the firewall shows an exact, constant offset of one hour, check the time zone first. If the displayed time keeps drifting or shows an obviously incorrect date, the time source or synchronization is the more likely cause.

Accurate time also provides a common reference for the firewall, syslog or SIEM, endpoints, servers, switches, and VPN peers. Without this common reference, reconstructing an event across multiple systems becomes difficult.

Choose the appropriate time source

SFOS 22 provides three operating modes under Administration > Time.

Use predefined NTP server is the default setting. The firewall uses NTP version 3 and synchronizes with 0.sophos.pool.ntp.org. This is the simplest choice for many internet-connected standalone sites. Because the firewall uses an FQDN, DNS resolution, routing, and outbound UDP 123 must work.

Use custom NTP server is suitable for organizations with internal time servers, controlled external sources, or isolated networks. One can enter IPv4 addresses, IPv6 addresses, or domain names. SFOS allows up to ten servers and checks them in the displayed order until one responds.

This list is ordered failover, not a quorum: the firewall uses the first responding server and does not compare multiple time sources. The preferred and most reliable source should therefore appear first.

For a custom configuration, we recommend at least two independently reachable time sources. Two names for the same server do not provide redundancy; use separate internal time servers or deliberately selected sources that do not depend on the same single system. Example names are:

ntp01.example.net
ntp02.example.net

example.net is a reserved example domain. Replace both names with the actual internal or external NTP servers. FQDNs require working DNS. Direct IP addresses avoid this dependency but must be updated on every firewall when a server changes.

Do not use NTP server allows Date and Time to be set manually. This is appropriate only as a justified temporary measure when no time source is reachable. A manually set clock drifts and can affect authentication, certificate imports, and VPN. A reachable NTP source is the more robust choice for ongoing operation.

Configure system time in SFOS 22

On a firewall that is already in production, document Current time, Time zone, the current operating mode, the server order, and active IPsec tunnels before changing servers. Then configure the system time as follows:

1. Open Administration > Time.
2. Check the existing value under Current time.
3. Under Time zone, select the firewall’s actual location, for example, Europe/Zurich.
4. Select Use predefined NTP server, Use custom NTP server, or Do not use NTP server only for a justified exception.
5. For custom time sources, enter each server and add it with Add. Check the intended order.
6. Click Sync now if an NTP server is configured.
7. Save with Apply.
8. Reload WebAdmin and check Current time again.

Select the time zone based on the firewall’s physical location, not the location of the administrator currently signed in. This is particularly important in international environments, as schedules and planned work may otherwise run at the wrong local time.

Set up Sophos Firewall schedules for rules and policies covers the complete process from the time object to rule validation.

If synchronization with the new servers fails, restore the previously documented operating mode or server list, run Sync now again when NTP is enabled, and save with Apply. Sync now does not apply to Do not use NTP server. This second server change may also reconnect IPsec tunnels, so the rollback belongs in the same maintenance window. Afterwards, check Current time and every tunnel that was previously active.

Verify synchronization properly

A saved server list does not prove that synchronization works. Combine several observations for acceptance:

1. Reload WebAdmin after Sync now and compare Current time with a trusted reference that is itself synchronized.
2. Generate a new log entry or test event, then compare the time and time zone in Log Viewer or the SIEM.
3. After changing NTP servers, make sure every previously active IPsec tunnel has re-established.
4. With custom servers, verify that more than one time source is actually reachable over the intended network path.
5. For time-based rules or maintenance windows, check the next known execution time without unnecessarily changing a production schedule.

Sophos does not publish a general maximum time deviation for SFOS 22 that would indicate success in every environment. What matters is that the firewall remains synchronized with the selected source, the local time zone is correct, and correlated systems show the same event time.

When NTP does not synchronize

Start with the simplest dependency, then follow the actual packet path.

Incorrect display despite a successful sync

Reload WebAdmin first. Current time does not update automatically on an already open page after Sync now. If a constant one-hour offset remains, compare Time zone with the firewall’s location.

The server name does not resolve

The predefined server and custom FQDN destinations require DNS. Under Network > DNS, use Test name lookup to test 0.sophos.pool.ntp.org or the custom server name. If resolution fails, correct the DNS servers, DNS Request Routes, and network path to the resolver first.

The server resolves but does not respond

Under Diagnostics > Tools, use Route Lookup to check which gateway and interface are used to reach the server IP address. Then open Diagnostics > Packet capture > Configure, enter a narrow filter for the destination IP address and UDP 123 under Enter BPF string, and save it with Save. Turn on the capture, trigger Sync now, and turn the capture off again after the test. For the example server 192.0.2.20, use:

host 192.0.2.20 and udp port 123

In a working flow, one can see a request generated by the firewall and the corresponding response. If the request is missing, check the route, active WAN path, and possible SD-WAN steering. If only the response is missing, the most likely causes are the NTP server, an upstream ACL, the provider path, or the return route.

The firewall’s NTP is system-generated traffic. A regular LAN-to-WAN firewall rule is therefore not reliable proof that it works. If multiple links or SD-WAN are involved, Route system-generated traffic with SD-WAN explains how to verify the actual outbound path.

Check the NTP client log

The relevant log is ntpclient.log. It can be downloaded with the other diagnostic logs under Diagnostics > Tools > Troubleshooting logs. For a short live check, after signing in to Sophos Firewall using SSH, open 5. Device Management > 3. Advanced Shell and run this read-only command:

tail -f /log/ntpclient.log

Trigger Sync now once, save the new lines, and stop the live output with Ctrl+C. SFOS 22 does not guarantee one specific success message across every version and configuration. Evaluate the server name, timestamp, and error messages together with the DNS, route, and capture results. Sophos Firewall services and logs lists other log files and their purposes.

Operations, Central, and restore

Sophos Central Firewall Management cannot synchronize NTP settings to the firewall. The settings are maintained directly on each firewall. For multiple firewalls, document the intended time source and time zone strategy and perform spot checks after changes.

A backup restores the time zone and NTP settings, but not a manually configured date and time. After a restore, acceptance must therefore include Current time, Time zone, the NTP selection, and a test of the dependent services. The complete procedure is covered in Back up or restore Sophos Firewall.

FAQ