Configuring NTP on 3CX Debian Appliances for Accurate Time

Overview

Accurate system time is critical for all 3CX phone systems. In the Webvault environment, inbound access to public NTP servers (such as the Debian or Google NTP pools) may be restricted by firewall policy. This can prevent a 3CX appliance from synchronizing its time automatically unless the NTP configuration is explicitly set to use Webvault’s internal NTP source. This guide explains how to configure and verify NTP on Debian-based 3CX servers used within the Webvault environment, ensuring accurate and reliable time synchronization.

1. Check Current Time and Sync Status

SSH into the 3CX appliance as root and run:

timedatectl

Example output:

               Local time: Sat 2025-10-25 11:26:41 AWST
           Universal time: Sat 2025-10-25 03:26:41 UTC
                 RTC time: Sat 2025-10-25 03:26:41
                Time zone: Australia/Perth (AWST, +0800)
System clock synchronized: yes
              NTP service: active
          RTC in local TZ: no

If System clock synchronized: no, proceed with configuration.

2. Ensure systemd-timesyncd Is Installed

The 3CX Debian installer performs an outbound NTP reachability test. If external NTP servers are blocked by firewall policy, the installer may skip installing the systemd-timesyncd service entirely.

Verify whether the service is present:

systemctl status systemd-timesyncd

If the service is missing or reports Unit could not be found, install it manually:

apt update
apt install systemd-timesyncd -y

Then enable and start the service:

systemctl enable --now systemd-timesyncd

Once installed, continue to the configuration steps below.

3. Edit NTP Configuration

Open the timesyncd configuration file:

sudo nano /etc/systemd/timesyncd.conf

Add or modify the following section and uncomment the # at the start of each line (as required):

[Time]
NTP=ntp.webvault.com.au
RootDistanceMaxSec=5
PollIntervalMinSec=32
PollIntervalMaxSec=2048
ConnectionRetrySec=30
SaveIntervalSec=60

Note:ntp.webvault.com.au should be reachable through the Webvault firewall and is the preferred source for internal time sync.

Save and exit (Ctrl+O, Enter, Ctrl+X).

4. Restart and Re-enable NTP Sync

Restart the NTP service and enable automatic synchronization:

sudo systemctl restart systemd-timesyncd
sudo timedatectl set-ntp true

5. Verify Synchronization

Recheck the status:

timedatectl

You should now see:

System clock synchronized: yes
NTP service: active

To view detailed sync info:

timedatectl show-timesync --all

Expected output:

ServerName=ntp.webvault.com.au
ServerReachable=yes

6. Ensure Correct Timezone

Check what timezone is currently configured:

timedatectl | grep 'Time zone'

If the timezone is incorrect or not set to Perth, adjust it as follows:

sudo timedatectl set-timezone Australia/Perth

7. Update the Hardware Clock

Once the time is correct, sync it to the VM’s hardware clock to allow accurate time between reboots:

sudo hwclock --systohc