Here's how we do it on RHEL:
Logged in as root:
* Create file at /etc/cron.hourly/clockset
* with these two lines only:
rdate -s time-a.nist.gov > /dev/null
hwclock --systohc > /dev/null
* chmod 700 /etc/cron.hourly/clockset
and yes, you do have to open your firewall to ntp; it's on port 123.
Jeff