We are using several Dell switches (S3124, S3048 and S4048, running OS9) in a network and want to use them as ntp-sources. That works fine, but none of these responds to NTP queries (ntpq -pn).
What I would like to do is monitor that they are NTP synced. If NTP query isn't available, is there another way to check that they are synced?
These are points and suggestions, not really an answer.
Don't do this. If your switches are important to the functioning of your network (which is usually the case :-), you want their management plane to be fully working if something bad happens. One of the bad things that can happen is Denial-of-Service Reflection Attacks using NTP as a reflector, and switch vendors are often behind on patching this. So if you somehow get this kind of malware in your network, you want your switches to be usable while you're troubleshooting.
ntpq -pn is a diagnostic command using an NTP mode 6 packet, not a normal NTP client packet. So just because you can't query the switches using mode 6 doesn't mean they won't serve time. Try adding them to a client configuration (or using the deprecated one-shot client ntpdate) to test.
To see NTP stats equivalent to ntpq -pn, log into the switch and use a local diagnostic command. I'm not sure what they are on those switches, but on Cisco IOS, the command is show ntp associations, and it's likely to be similar on those Dells.
You should also double-check what NTP permissions your switch OS gives to remote hosts by default. The fact that it doesn't respond to ntpq -pn by default is a good sign, but carefully check what ACLs you have created or commands you have run to ensure that it stays secure against abuse from external hosts.
