W32Time Service (specifically NTP/ SNTP) Time Sync problems

[Lt2]

Problem is setting The Primary Domain Controller Emulator to provide time keeping services to my network.
DSL MODEM
Netgear Firewall Router
I have 2 Windows 2003 Servers (SE) set with a 50/50 scope
The Primary Domain Controller is lets say Pecan

I have been working on this problem for almost 2 months now and I am at loss for the solution. I have been plagued with windows 32time event IDs and none of them are happy ones. These are the ones that say accurate time source can not be found, No response from the specified DNS name or is invalid data.
Now throughout these months I have searched in great detail, the information available on the net and have learned a great deal.
I have learned various command prompt, commands

net stop w32time
w32time -update
net start w32time

and
net time /setsntp:domain controller. for me this would be Pecan.

Here is a link to the NIST Internet Time Service http://www.boulder.nist.gov/timefreq/service/time-servers.html lists the time servers used by the NIST Internet Time Service (ITS).

I have used net time /setsntp:132.163.4.101 (Avoids DNS confusion) I then go to one of the workstations and from the prompt do net time it will report the time from PECAN When I ping the above IP it is successful. I have tried many addresses from the page at the link above with the results the same pingable addresses. This tells me, I hope, that my commands were successful and that Pecan is indeed recognized as the authoritative time source. However Pecan is unable to establish contact even though I can ping to those IPs. Port 123 is enabled in the firewall.

So what could be the cause?

I have tried the net time command from the other DC and it reports that it isn't able to get time from PECAN So what is blocking the service?
The workstations are successful with the net time I know the solution has to be something small any help would be appreciated.

 

[Michael Last]

Have tried to solve it also and find out the following:
The NTP-Port (123) in Windows 2003 does not support NAT. Have checked
that in my environment and that fixed the problem for me. Maybe it
helps you also.

Good Luck

 

[root127]

SNTP protocol requires an accurate time source before any of your time clients will accept a reply from the time server even though your domain controller is sending out the correct packet information.

if you use a packet sniffer like etherial you will see the full communication when you use w32time to update but you will notice that the reply from your server will state

Reference Clock ID: Unidentified reference source

if you were to set both your domain controllers and client computers to an internet time source it will work because the internet sources are based off of either GPS or an atomic clock.