For the time... you can check time in BIOS if it does not keep the correct settings... as per VMware KB1003736 states:
"Verify the time set in the hardware BIOS of the ESX/ESXi host if this host is experiencing difficulty keeping time, despite it having its time correctly set and successfully connected to running and correctly configured NTP server."
Are the 3 host all the same HW, if yes check for BIOS version etc..
Also note : Time displayed in the Client is local time of the device you use to connect to it, as time showed in esx shell is UTC which is +5 for me.
For the firewall, I am not sure.. what version are you ESXi hosts?