Problem with internet time on clients with HP 1820-48G switch

[Thyrador]

Hey folks.

After replacing my Procurve 1810-24G with an OfficeConnect 1820-48G I lost the ability to get the correct time for all of my windows clients.

I tried a lot but could not get it to work. The switch itself gets the time without issues. If I change connectivity to wifi on the client I can get the correct time from any time server from the internet. When connecting it via cable (switch) it will not work at all. I just get a timeout when trying to synchronize time.

Any Idea what to change to get it to work again? It worked on the old Procurve though, so it must be something with the new one.

[parnassus]

First of all you need to be sure that HPE OfficeConnect 1820 Switch Series supports NTP Server feature (not only it should be able to act as an SNTP/NTP Client, a feature that it supports, but also it need to be able to act as an SNTP/NTP Server for other directly connected devices). Are you sure about that?

Reading the HPE OfficeConnect 1820 Switch Series Management and Configuration Guide, it looks like it isn't capable to act as SNTP/NTP Server for other devices (also considering its latest PT.02.03 software version).

Laconic sentence from "Time Configuration" chapter (Sheet 3-6) of the above cited guide: "Software operates only as an SNTP client and cannot provide time services to other systems".

[Thyrador]

Thank you for replying. I didn't meant to use it as an SNTP/NTP server. I already got one in my network which works just fine.

But after the upgrade all my clients can't reach that server anymore to synchronize time. Even if I set them to use any internet time server, they simply time out every time. For my understanding it should be simply forward the traffic to the clients, not messing around with it.

So does that simple thing really not work on that switch? To be honest: that would be the first one I got not being capable of doing that. Even simple unmanaged switches were able to not break time synchronization in my clients.

Anyway: did you think there's a way around? Because it's extremely annoying and you notice some time differences the next day.

[parnassus]

OK, scenario is clear now...frankly I doubt a switch (any switch) once in default configuration will block certain traffic (NTP, as example)...so the cause of your issue IMHO would be elsewhere...first of all, clients ping your internal NTP?

[Thyrador · Accepted solution]

That's what I thought too. But it definately is the switch which is causing the issues here. As I said, I tried WiFi, everything works fine. If I try a cheap and simple 16 or 24 port unmanaged switch, everything works as expected too.

Now we come to the fun part: I tried to ping any time servers I usually use: none of them can be pinged (tried that via WiFi too, did not receive a packed, but time get synced properly). What's more curious: my very own SNTP-server can be pinged, but I still won't get the time synced (only when connecting via WiFi).

I have set up 3 VLANs, I'm not sure if the issue is with that configuration in some way.

EDIT: I finally found out, what caused the issue(s):
Prevent TCP Blat Attack
When enabled, the switch drops packets that have a TCP source port equal to the TCP destination port.
Prevent UDP Blat Attack
When enabled, the switch drops packets that have a UDP source port equal to the UDP destination port.

If I disable both options, I can sync the time again. And suddenly I receive all 4 packets when pinging an adress in most cases.

Thanks anyway for your help. I really appreciate it :)

[parnassus]

So...good shot...I chime in too late but...after all still nice reading here (WRT enabling Auto DoS on HP 1810...and, at this point, given the features are similar if not totally equals, also on HP 1820).

[Thyrador]

Well, I just disabled these 2 options, everything else seem to work, kind of.
But thanks for the link, though. Wish I had found that earlier :D