Why FortiGate NTP Fails: Firewall Policy Required
An administrator wants to synchronize the FortiGate's time with a reliable NTP server. After configuring the NTP server, they notice the time is still incorrect. What could be the issue?
Quick Answer
The answer is that the FortiGate lacks a firewall policy allowing NTP traffic sourced from its own interface IP. This is correct because FortiGate enforces policy-based forwarding for all traffic, including traffic generated by the device itself—such as NTP synchronization requests—meaning that even if the NTP server is reachable, the outbound UDP port 123 packets are dropped without an explicit permit policy. On the Fortinet NSE 4 Network Security Professional exam, this question tests your understanding of local-out traffic and the common trap that self-originated traffic bypasses firewall rules; in reality, it does not. A reliable memory tip is "Self traffic needs a policy too"—always create a policy with the source set to the FortiGate’s interface IP and the destination to the NTP server to resolve a FortiGate NTP synchronization issue.
⚠ Common exam trap
Many exam-takers assume NTP traffic is automatically allowed for management purposes, but FortiGate treats all traffic, including its own, as subject to firewall policies, so a missing explicit policy is a common oversight.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The FortiGate does not have a firewall policy allowing NTP traffic from the FortiGate itself
By default, FortiGate does not allow traffic sourced from its own IP addresses, including NTP queries, to pass through its interfaces unless an explicit firewall policy permits it. Even if the NTP server is reachable via routing, the FortiGate's own NTP client traffic is subject to the same policy enforcement as any other traffic. Therefore, a firewall policy must be created with the source set to the FortiGate's interface IP and the destination set to the NTP server to allow NTP (UDP port 123) traffic outbound.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The FortiGate does not have a firewall policy allowing NTP traffic from the FortiGate itself
Why this is correct
Traffic from the FortiGate to the NTP server must be allowed by a policy.
- ✗
The NTP server is not reachable due to a missing route
Why it's wrong here
This is a possibility but less specific than a firewall policy issue.
- ✗
The FortiGate does not support NTP
Why it's wrong here
It does.
- ✗
The NTP server is not configured correctly
Why it's wrong here
Not specified.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which of the following is required to allow a FortiGate to synchronize its clock with an NTP server?
easy- ✓ A.Firewall policy allowing NTP traffic (UDP 123) from the FortiGate to the NTP server
- B.Enable NTP in the admin settings
- C.Set the timezone using config system global
- D.Disable daylight saving time
Why A: A FortiGate synchronizes its clock with an NTP server using NTP traffic, which relies on UDP port 123. Without a firewall policy that explicitly permits outbound UDP 123 traffic from the FortiGate to the NTP server, the NTP packets are dropped by the FortiGate's own firewall engine, preventing clock synchronization. This policy is required even for traffic originating from the FortiGate itself, as the FortiGate applies firewall rules to all traffic, including management traffic.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.