{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/review-pfsense-boot-time-clock-bootstrap-separately-from-its-running-ntp-service/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/review-pfsense-boot-time-clock-bootstrap-separately-from-its-running-ntp-service/",
        "slug": "review-pfsense-boot-time-clock-bootstrap-separately-from-its-running-ntp-service",
        "url": "https://update.dsesecurity.com/updates/review-pfsense-boot-time-clock-bootstrap-separately-from-its-running-ntp-service/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/review-pfsense-boot-time-clock-bootstrap-separately-from-its-running-ntp-service.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/review-pfsense-boot-time-clock-bootstrap-separately-from-its-running-ntp-service/"
        },
        "title": "Review pfSense boot-time clock bootstrap separately from its running NTP service",
        "summary": "A firewall can contact bootstrap time servers before the persistent daemon starts.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "video-evidence",
            "label": "Video evidence & analytics",
            "alt": "Multiple synchronized camera views converging into a verifiable evidence frame.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/video-evidence-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/video-evidence-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/video-evidence-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:16:23+00:00",
        "modified_at": "2026-10-20T18:34:35+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 243,
        "potentially_affected": "This concerns pfSense clock bootstrap behavior before the NTP daemon.",
        "dse_recommendation": "DSE recommends including boot-time dependencies in restricted-egress and time-service designs.",
        "primary_source": {
            "name": "Netgate — Clock Bootstrap Behavior",
            "url": "https://docs.netgate.com/pfsense/en/latest/services/ntpd/bootstrap.html",
            "published_on": null,
            "authority": "docs.netgate.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>A firewall can contact bootstrap time servers before the persistent daemon starts.</p>\n<h2>Source facts</h2>\n<p>Netgate documents two once-per-boot clock actions: using recent filesystem timestamps and making a one-time sync to static-IP NTP servers. The latter avoids a DNSSEC dependency when an inaccurate clock prevents resolving time-server names. A dedicated ntp-boot-time-servers file can supply alternate IPs; an existing empty file disables that initial network sync.</p>\n<p>Source: <a href=\"https://docs.netgate.com/pfsense/en/latest/services/ntpd/bootstrap.html\">Netgate — Clock Bootstrap Behavior</a>.</p>\n<h2>Applicability</h2>\n<p>This concerns pfSense clock bootstrap behavior before the NTP daemon.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends including boot-time dependencies in restricted-egress and time-service designs. If policy requires approved time sources, configure a reachable bootstrap path instead of assuming the ordinary NTP server list covers startup. Preserve the custom file through the documented recovery process and record why it exists. Consider how a long shutdown affects timestamp-based approximation before disabling network bootstrap entirely. Ask the time-service owner to review boot-time and steady-state destinations on separate lines. If bootstrap is deliberately disabled or redirected, preserve the reason and an approved recovery test. Keep the bootstrap file choice in the rebuild inventory so replacement hardware follows the same clock-startup decision.</p>\n<h2>Verification</h2>\n<p>In an isolated reboot rehearsal, observe the early clock, bootstrap traffic, DNSSEC resolution, and subsequent daemon synchronization as separate events. Confirm the configured alternate IPs are reachable at that stage. Record the resulting startup sequence without claiming that a healthy steady-state NTP peer proves every boot-time dependency is satisfied.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.netgate.com/pfsense/en/latest/services/ntpd/bootstrap.html\">Netgate — Clock Bootstrap Behavior</a>. Reviewed October 20, 2026.</p>",
        "content_text": "A firewall can contact bootstrap time servers before the persistent daemon starts.\nSource facts\nNetgate documents two once-per-boot clock actions: using recent filesystem timestamps and making a one-time sync to static-IP NTP servers. The latter avoids a DNSSEC dependency when an inaccurate clock prevents resolving time-server names. A dedicated ntp-boot-time-servers file can supply alternate IPs; an existing empty file disables that initial network sync.\nSource: Netgate — Clock Bootstrap Behavior.\nApplicability\nThis concerns pfSense clock bootstrap behavior before the NTP daemon.\nDSE recommendation\nDSE recommends including boot-time dependencies in restricted-egress and time-service designs. If policy requires approved time sources, configure a reachable bootstrap path instead of assuming the ordinary NTP server list covers startup. Preserve the custom file through the documented recovery process and record why it exists. Consider how a long shutdown affects timestamp-based approximation before disabling network bootstrap entirely. Ask the time-service owner to review boot-time and steady-state destinations on separate lines. If bootstrap is deliberately disabled or redirected, preserve the reason and an approved recovery test. Keep the bootstrap file choice in the rebuild inventory so replacement hardware follows the same clock-startup decision.\nVerification\nIn an isolated reboot rehearsal, observe the early clock, bootstrap traffic, DNSSEC resolution, and subsequent daemon synchronization as separate events. Confirm the configured alternate IPs are reachable at that stage. Record the resulting startup sequence without claiming that a healthy steady-state NTP peer proves every boot-time dependency is satisfied.\nOfficial reference\nNetgate — Clock Bootstrap Behavior. Reviewed October 20, 2026.",
        "content_markdown": "A firewall can contact bootstrap time servers before the persistent daemon starts.\n\n## Source facts\n\nNetgate documents two once-per-boot clock actions: using recent filesystem timestamps and making a one-time sync to static-IP NTP servers. The latter avoids a DNSSEC dependency when an inaccurate clock prevents resolving time-server names. A dedicated ntp-boot-time-servers file can supply alternate IPs; an existing empty file disables that initial network sync.\n\nSource: [Netgate — Clock Bootstrap Behavior](https://docs.netgate.com/pfsense/en/latest/services/ntpd/bootstrap.html).\n\n## Applicability\n\nThis concerns pfSense clock bootstrap behavior before the NTP daemon.\n\n## DSE recommendation\n\nDSE recommends including boot-time dependencies in restricted-egress and time-service designs. If policy requires approved time sources, configure a reachable bootstrap path instead of assuming the ordinary NTP server list covers startup. Preserve the custom file through the documented recovery process and record why it exists. Consider how a long shutdown affects timestamp-based approximation before disabling network bootstrap entirely. Ask the time-service owner to review boot-time and steady-state destinations on separate lines. If bootstrap is deliberately disabled or redirected, preserve the reason and an approved recovery test. Keep the bootstrap file choice in the rebuild inventory so replacement hardware follows the same clock-startup decision.\n\n## Verification\n\nIn an isolated reboot rehearsal, observe the early clock, bootstrap traffic, DNSSEC resolution, and subsequent daemon synchronization as separate events. Confirm the configured alternate IPs are reachable at that stage. Record the resulting startup sequence without claiming that a healthy steady-state NTP peer proves every boot-time dependency is satisfied.\n\n## Official reference\n\n[Netgate — Clock Bootstrap Behavior](https://docs.netgate.com/pfsense/en/latest/services/ntpd/bootstrap.html). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/review-pfsense-boot-time-clock-bootstrap-separately-from-its-running-ntp-service/",
                "url": "https://update.dsesecurity.com/updates/review-pfsense-boot-time-clock-bootstrap-separately-from-its-running-ntp-service/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/review-pfsense-boot-time-clock-bootstrap-separately-from-its-running-ntp-service/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Cybersecurity",
                        "item": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Review pfSense boot-time clock bootstrap separately from its running NTP service",
                        "item": "https://update.dsesecurity.com/updates/review-pfsense-boot-time-clock-bootstrap-separately-from-its-running-ntp-service/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/review-pfsense-boot-time-clock-bootstrap-separately-from-its-running-ntp-service/#article",
                "identifier": "https://update.dsesecurity.com/updates/review-pfsense-boot-time-clock-bootstrap-separately-from-its-running-ntp-service/",
                "url": "https://update.dsesecurity.com/updates/review-pfsense-boot-time-clock-bootstrap-separately-from-its-running-ntp-service/",
                "headline": "Review pfSense boot-time clock bootstrap separately from its running NTP service",
                "description": "A firewall can contact bootstrap time servers before the persistent daemon starts.",
                "abstract": "A firewall can contact bootstrap time servers before the persistent daemon starts.",
                "articleBody": "A firewall can contact bootstrap time servers before the persistent daemon starts.\nSource facts\nNetgate documents two once-per-boot clock actions: using recent filesystem timestamps and making a one-time sync to static-IP NTP servers. The latter avoids a DNSSEC dependency when an inaccurate clock prevents resolving time-server names. A dedicated ntp-boot-time-servers file can supply alternate IPs; an existing empty file disables that initial network sync.\nSource: Netgate — Clock Bootstrap Behavior.\nApplicability\nThis concerns pfSense clock bootstrap behavior before the NTP daemon.\nDSE recommendation\nDSE recommends including boot-time dependencies in restricted-egress and time-service designs. If policy requires approved time sources, configure a reachable bootstrap path instead of assuming the ordinary NTP server list covers startup. Preserve the custom file through the documented recovery process and record why it exists. Consider how a long shutdown affects timestamp-based approximation before disabling network bootstrap entirely. Ask the time-service owner to review boot-time and steady-state destinations on separate lines. If bootstrap is deliberately disabled or redirected, preserve the reason and an approved recovery test. Keep the bootstrap file choice in the rebuild inventory so replacement hardware follows the same clock-startup decision.\nVerification\nIn an isolated reboot rehearsal, observe the early clock, bootstrap traffic, DNSSEC resolution, and subsequent daemon synchronization as separate events. Confirm the configured alternate IPs are reachable at that stage. Record the resulting startup sequence without claiming that a healthy steady-state NTP peer proves every boot-time dependency is satisfied.\nOfficial reference\nNetgate — Clock Bootstrap Behavior. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:16:23+00:00",
                "dateModified": "2026-10-20T18:34:35+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/review-pfsense-boot-time-clock-bootstrap-separately-from-its-running-ntp-service/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/review-pfsense-boot-time-clock-bootstrap-separately-from-its-running-ntp-service/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/video-evidence-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/video-evidence-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Review pfSense boot-time clock bootstrap separately from its running NTP service"
                },
                "articleSection": [
                    "Cybersecurity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Cybersecurity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 243,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Netgate — Clock Bootstrap Behavior",
                    "url": "https://docs.netgate.com/pfsense/en/latest/services/ntpd/bootstrap.html"
                }
            }
        ]
    }
}