This knowledge article addresses an issue where users encounter a "Request Timed Out" error when checking NTP associations on a device.

The issue typically occurs when the NTP traffic, specifically UDP port 123, is being blocked by firewall or filter settings, preventing successful communication with the NTP server.

This article explains the cause of the issue, provides troubleshooting steps, and outlines the solution to restore proper NTP synchronization

When checking the NTP status, a "Request Timed Out" error occurs. The output of the show ntp associations command shows the following message:

root@device> show ntp associations 
localhost: timed out, nothing received
***Request timed out 

The NTP client is not able to establish a connection with the server due to a blockage in the network traffic, particularly the UDP packets needed for NTP synchronization.

Follow the below mentioned troubleshooting steps to resolve the NTP Issue

• Verify the NTP Configuration 

  
  

  Check the customer NTP configuration that no errors were found in the configuration that could cause the issue.

   

• Traffic Monitoring:      

   

  Monitored the traffic on the device's interface to verify that NTP query packets were reaching the interface. The following command was used to inspect NTP traffic on interface me0:

  monitor traffic interface me0 matching "udp port 123"
  
  

  Do observe whether the packet flow show both incoming and outgoing NTP packets, check that NTP traffic was being received but not processed successfully due to a blockage. 

   

• Firewall and Filter Configuration.                

Check whether device's firewall configuration, specifically the "Protect RE" filter, was checked to see if the traffic was being inadvertently blocked.

 In my case the following configuration was found.

          set firewall family inet filter PROTECT-RE term DNS from protocol udp
          set firewall family inet filter PROTECT-RE term DNS from port 53
          set firewall family inet filter PROTECT-RE term DNS then policer LIMIT-1M
          set firewall family inet filter PROTECT-RE term DNS then accept
          set firewall family inet filter PROTECT-RE term DENY-ELSE then discard

From the above filter configuration only allowed UDP traffic on port 53 (DNS) and blocked all other UDP traffic, including the required NTP UDP port 123.                

     Configure the firewall filter to allow the UDP Port 123:

Explicitly allow UDP port 123 in the firewall filter to ensure that NTP traffic is not blocked. The following configuration was added to the "Protect RE" filter:

      set firewall family inet filter PROTECT-RE term NTP from protocol udp
      set firewall family inet filter PROTECT-RE term NTP from port 123
      set firewall family inet filter PROTECT-RE term NTP then accept

Post adding the below configuration by allowing UDP port 123 in the firewall filter, NTP traffic is no longer block and the NTP timeout issue was resolved, restoring proper time synchronization on the device.