Configure system time and NTP on Sophos Firewall

Under Administration > Time, you configure the clock of Sophos Firewall itself. For a typical internet-connected firewall, the following is usually sufficient: select the appropriate Time zone, leave Use predefined NTP server enabled, click Sync now, save with Apply, and reload WebAdmin. Current time only shows the updated value after the page has been reloaded.

This setting does not automatically turn the firewall into an NTP server for internal devices. If clients must use the gateway IP address as their time server, Use Sophos Firewall as an NTP relay explains the separate NAT procedure.

⚠️ When the configured NTP servers are changed, all IPsec tunnels reconnect. A server change therefore belongs in a maintenance window. Sophos does not document this reconnect for Sync now alone when the server list remains unchanged.

Why system time and time zone matter separately

NTP synchronizes a common absolute time reference based on UTC. The Time zone determines how the firewall displays this time locally and when local schedules take effect. This can result in two different types of error:

• The actual time is incorrect: Certificates may appear not yet valid or expired, authentication and MFA may fail, and VPN connections may not establish.
• The time zone is incorrect: Synchronization may work technically, while log entries, reports, maintenance windows, or time-based rules appear shifted by one or more hours.

This distinction is important for troubleshooting. If the firewall shows an exact, constant offset of one hour, check the time zone first. If the displayed time keeps drifting or shows an obviously incorrect date, the time source or synchronization is the more likely cause.

Accurate time also provides a common reference for the firewall, syslog or SIEM, endpoints, servers, switches, and VPN peers. Without this common reference, reconstructing an event across multiple systems becomes difficult.

Choose the appropriate time source

SFOS 22 provides three operating modes under Administration > Time.

Use predefined NTP server is the default setting. The firewall uses NTP version 3 and synchronizes with 0.sophos.pool.ntp.org. This is the simplest choice for many internet-connected standalone sites. Because the firewall uses an FQDN, DNS resolution, routing, and outbound UDP 123 must work.

Use custom NTP server is suitable for organizations with internal time servers, controlled external sources, or isolated networks. One can enter IPv4 addresses, IPv6 addresses, or domain names. SFOS allows up to ten servers and checks them in the displayed order until one responds.

This list is ordered failover, not a quorum: the firewall uses the first responding server and does not compare multiple time sources. The preferred and most reliable source should therefore appear first.

For a custom configuration, we recommend at least two independently reachable time sources. Two names for the same server do not provide redundancy; use separate internal time servers or deliberately selected sources that do not depend on the same single system. Example names are:

ntp01.example.net
ntp02.example.net

example.net is a reserved example domain. Replace both names with the actual internal or external NTP servers. FQDNs require working DNS. Direct IP addresses avoid this dependency but must be updated on every firewall when a server changes.

Do not use NTP server allows Date and Time to be set manually. The suggested values are based on the Time zone selected above. This is appropriate only as a justified temporary measure when no time source is reachable. A manually set clock drifts and can affect authentication, certificate imports, and VPN. A reachable NTP source is the more robust choice for ongoing operation.

Configure system time in SFOS 22

On a firewall that is already in production, document Current time, Time zone, the current operating mode, the server order, and active IPsec tunnels before changing servers. Then configure the system time as follows:

1. Open Administration > Time.
2. Check the existing value under Current time.
3. Under Time zone, select the firewall’s actual location, for example, Europe/Zurich.
4. Select Use predefined NTP server, Use custom NTP server, or Do not use NTP server only for a justified exception.
5. For custom time sources, enter each server and add it with Add. Check the intended order.
6. Click Sync now if an NTP server is configured.
7. Save with Apply.
8. Reload WebAdmin and check Current time again.

Select the time zone based on the firewall’s physical location, not the location of the administrator currently signed in. This is particularly important in international environments, as schedules and planned work may otherwise run at the wrong local time.

Set up Sophos Firewall schedules for rules and policies covers the complete process from the time object to rule validation.

If synchronization with the new servers fails, restore the previously documented operating mode or server list, run Sync now again when NTP is enabled, and save with Apply. Sync now does not apply to Do not use NTP server. This second server change may also reconnect IPsec tunnels, so the rollback belongs in the same maintenance window. Afterwards, check Current time and every tunnel that was previously active.

CLI: Set the system date only as a temporary emergency measure

In the CLI, 2. System Configuration > 2. Set System Date opens the manual entry. If NTP is configured, SFOS warns about the change and automatically disables the NTP settings when the date is set manually. This is not a one-time correction while NTP continues running. Therefore, first record the current time, time zone, NTP mode, and server order.

After confirmation with y, SFOS requests the month from 01 to 12, day from 01 to 31, year, hour from 00 to 23, and minute from 00 to 59, then displays the new date. Compare the displayed time with a trusted reference before leaving the menu.

After this emergency action, re-enable the intended NTP source under Administration > Time, synchronize with Sync now, and save with Apply. Then reload WebAdmin and verify Current time, Time zone, a new log entry, and time-dependent services such as MFA, certificates, and VPN. A manually maintained clock is not an acceptable permanent state.

Verify synchronization properly

A saved server list does not prove that synchronization works. Combine several observations for acceptance:

1. Reload WebAdmin after Sync now and compare Current time with a trusted reference that is itself synchronized.
2. Generate a new log entry or test event, then compare the time and time zone in Log Viewer or the SIEM.
3. After changing NTP servers, make sure every previously active IPsec tunnel has re-established.
4. With custom servers, verify that more than one time source is actually reachable over the intended network path.
5. For time-based rules or maintenance windows, check the next known execution time without unnecessarily changing a production schedule.

The configuration is successful when the firewall remains synchronized with the selected source, the local time zone is correct, and correlated systems show the same event time. Sophos does not specify a general maximum time deviation for SFOS 22 that would serve as a limit in every environment.

When NTP does not synchronize

Start with the simplest dependency, then follow the actual packet path.

Incorrect display despite a successful sync

Reload WebAdmin first. Current time does not update automatically on an already open page after Sync now. If a constant one-hour offset remains, compare Time zone with the firewall’s location.

The server name does not resolve

The predefined server and custom FQDN destinations require DNS. Under Network > DNS, use Test name lookup to test 0.sophos.pool.ntp.org or the custom server name. If resolution fails, check the DNS servers, DNS Request Routes, and network path to the resolver separately, then correct only the failing dependency.

The server resolves but does not respond

Under Diagnostics > Tools, use Route Lookup to check which gateway and interface are used to reach the server IP address. Then open Diagnostics > Packet capture > Configure, enter a narrow filter for the destination IP address and UDP 123 under Enter BPF string, and save it with Save. Turn on the capture, trigger Sync now, and turn the capture off again after the test. For the example server 192.0.2.20, use:

host 192.0.2.20 and udp port 123

In a working flow, one can see a request generated by the firewall and the corresponding response. If the request is missing, check the route, active WAN path, and possible SD-WAN steering. If only the response is missing, the most likely causes are the NTP server, an upstream ACL, the provider path, or the return route.

The firewall’s NTP is system-generated traffic. A regular LAN-to-WAN firewall rule is therefore not reliable proof that it works. For an SD-WAN route to steer this traffic, routing for system-generated traffic must be enabled and at least one selected gateway must be Active. If every selected gateway is only Backup, the firewall doesn’t forward this traffic. Route system-generated traffic with SD-WAN explains verification and safe rollback.

Check the NTP client log

The relevant log is ntpclient.log. You can download it individually under Diagnostics > Tools > Troubleshooting logs; alternatively, a Consolidated Troubleshooting Report (CTR) contains all log files and a system snapshot. For a short live check, after signing in to Sophos Firewall using SSH, open 5. Device Management > 3. Advanced Shell and run this read-only command:

tail -f /log/ntpclient.log

Trigger Sync now once, save the new lines, and stop the live output with Ctrl+C. SFOS 22 doesn’t provide one fixed success message that looks the same in every version and configuration. Evaluate the server name, timestamps, and messages together with the DNS, route, and capture results; a saved server entry alone doesn’t prove successful synchronization. Sophos Firewall services and logs lists other log files and their purposes.

Operations, Sophos Fusion, and restore

Firewall Management in Sophos Fusion (formerly Sophos Central) cannot synchronize NTP settings to the firewall. Sophos supports configuration through WebAdmin, the CLI, or the Sophos Firewall API. For multiple firewalls, document the intended time source and time zone strategy and perform spot checks after changes.

A backup restores the time zone and NTP settings, but not a manually configured date and time. If Do not use NTP server must remain in effect after the restore, configure Date and Time again. Then verify Current time, Time zone, the NTP selection, and the dependent services. The complete procedure is covered in Back up or restore Sophos Firewall.

FAQ