Access Gate uses the NTP protocol to synchronize its software clock. A correct clock is critical for log timestamps, but also certificates and tunnels authentication. There is usually no need to configure NTP, as Access Gate self configures based (1) on the information received from a DHCP lease on its Overlay port, or (2) use the default time.google.com if none is set.
Check Existing Firewall Rules for Access Gate WAN Access
NTP requests egress on the path Access Gate uses to reach upstream time (not the monitoring, admin, or others...). In an overlay deployment that is the overlay interface; when Access Gate is deployed in-line, carrying VLANs or trunks and already in-path, the requests follow the in-line path natively. Either way, ensure your existing firewall rules allow outbound WAN connectivity for that egress.
To look for possible configuration errors in the logs, use the query eq "timemngr@60446" [component] and eq "E" [level]:
For an example setting NTP in a router:
/ip/dhcp-server-network
add address=100.65.0.0/29 gateway=100.65.0.1 ntp-server=100.65.0.2
Access Gate as a time source for OT
Keeping the gate's own clock accurate is only half the story. Because Access Gate is a VNF, a virtual appliance running on x86 hardware you own, security is decoupled from proprietary boxes and the same host can run the secure services that pull OT in. Accurate time is one of those services: once the gate is synchronized, it can serve NTP to the assets downstream of it, so PLCs, HMIs, and historians all agree on the clock without each one reaching out to the internet.
Point downstream assets at the Access Gate as their NTP server. In an overlay deployment they reach the time service through the overlay; in an in-line deployment, where the gate already carries the VLANs or trunks, the service is reachable natively on the in-path network with no overlay routing required. Serving time locally keeps timestamps consistent for logs, certificates, and tunnel authentication across the estate, and it removes an outbound dependency from every device that would otherwise need its own path to a public time source.
Recap
We confirmed Access Gate can reach an NTP server over its upstream path, checked the firewall rules for outbound WAN, and optionally pushed an NTP server via DHCP from the router. Reach for this when log timestamps are off or certificate and tunnel authentication fails because the appliance clock has drifted.