Warning : "Configuration is not working normally" during time synchronization test

Products

• VMware vCenter Server
• VMware vSphere ESXi

Issue/Introduction

• ESXi hosts fail to synchronize time with configured upstream NTP servers despite the service appearing as active. 
  
  
• The Network Time Protocol (NTP) service on VMware ESXi hosts shows as active but fails to synchronize time with configured upstream servers. When running Test Services under System > Time Configuration in the vSphere Client, you see a configuration warning.

• The command ntpq -p shows an .INIT. state with a reach value of 0.
  
  
  
  Note: The redacted information is the IP address or FQDN information of the remote server that ESXi host is binded with, for NTP sync.
  
  
• The ntpClient firewall ruleset allowed IP list is empty when checked via esxcli network firewall ruleset allowedip list.

• In the affected ESXi var/run/log/syslog, the following entries appear,

[YYYY-MM-DDTHH:MM:SS] In(30) ntpd[1000106440]: kernel reports TIME_ERROR: 0x6041: Clock Unsynchronized

[YYYY-MM-DDTHH:MM:SS] In(30) ntpd[1000106440]: kernel reports TIME_ERROR: 0x6041: Clock Unsynchronized

Environment

VMware vSphere ESXi 

Cause

The ntpClient firewall ruleset is enabled on the ESXi host, but the allowed IP list is empty. This configuration causes the ESXi firewall to drop all outgoing NTP traffic, preventing synchronization with remote servers.

Resolution

1. Log in to the ESXi host via SSH.

2. Check the current firewall allowed IP list for the NTP client:
   esxcli network firewall ruleset allowedip list | grep ntpClient
   Verify that the allowed IP list is empty or missing your target NTP server.

3. Stop the NTP service: esxcli system ntp set -e 0
4. Update the firewall allowed IP addresses to include your NTP server using one of the following methods:
   
   • To allow all IP addresses, run:
     esxcli network firewall ruleset set -a true -r ntpClient
   • To allow only a specific NTP server IP, run:
     esxcli network firewall ruleset allowedip add -i #### -r ntpClient
5. Start the NTP service: esxcli system ntp set -e 1
6. Verify synchronization by running ntpq -p.