NSX Distributed Firewall time-based policies fail to realize with Error Code 1001 due to NTP synchronization status

Products

• VMware vDefend Firewall

Issue/Introduction

• In the NSX manager console, time-based distributed firewall (DFW) policies may show a failed status.
• The realization status for transport nodes reports the following error:

[Error Code = '1001', Error Message = 'NTP Service was not configured.', Affected Entities : '[]'.]

• Investigation shows that while the NTP service may be active at the ESXi level, the policy realization consistently fails.
• NSX Manager "/var/log/syslog.log" shows the following error.

2025-12-31T06:53:17.194Z nsx.lab.com NSX 78164 SYSTEM [nsx@6876 comp="nsx-manager" level="INFO" subcomp="manager"] Returning current realization status 'Status = 'ERROR', Message = ''XX' transport nodes have reported errors.', TNs = '[TN = 'xx-xx-xx-xx', Status = 'ERROR', Message = '', Errors = '[Error Code = '1001', Error Message = ' NTP Service is not up', Affected Entities = '[]'.]'., TN = 'xx-xx-xx-xx', Status = 'ERROR', Message = '', Errors = '[Error Code = '1001', Error Message = ' NTP Service is not up', Affected Entities = '[]'.]'.

• • Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.
    

Environment

VMWare NSX 4.2.3.3 or earlier version
VMware vDefend Firewall

Cause

The issue is caused by the ESXi validation script /bin/check_ntp_cfg.sh, which returns a failure state ("0") if the refid field in the ntpq -p output is blank. A blank refid occurs when the ESXi host is synchronized with a remote NTP server that is not itself synchronized with an upstream NTP source. Because the validation script fails, NSX prevents the publication of time-based rules to ensure enforcement remains accurate to a reliable time source. 

[root@localhost:~] /bin/check_ntp_cfg.sh

0

[root@localhost:~] ntpq -p
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
*10.10.9.5               1 u 333 1024  377    0.128   -0.357   0.084

Resolution

A permanent fix for this issue is available in NSX 4.2.4 / 9.1.1.0 or later releases. 

To resolve this issue, ensure the NTP server used by the environment is synchronized with a valid upstream source:

1. Validate NTP Synchronization: Log in to the affected ESXi host and run ntpq -p. Verify if the refid field is populated. If it is blank, the NTP source must be corrected.
2. Verify Script Output: Run /bin/check_ntp_cfg.sh on the host. A successful state is indicated by a return value of "1".
3. Correct NTP Infrastructure: Update the NTP server configuration (e.g., Firewall or Router) to ensure it is synchronized with a reliable external time provider.

Workaround:

Temporarily point the ESXi hosts to a different, fully synchronized NTP server. Once synchronization is established and the refid is visible, the time-based DFW policies will successfully realize.

PR 3638566