@LEPM:

thanks for the info.
I think,only administrators,moderators, can delete  trheads.

As far as I know - and I did it one time in the past - you can close/delete your own created threads.

In this scenario I'm not so far to have load balancing or something else configured.
I have only outgoing NAT (from private to all IPs) for the three WANs.

Does loadbalancing change something for ipsec, if the pfsense the source of the packages?

@ermal:

I think this was fixed in latest snapshots just for this case!
Now you can define the different user under carp sync settings as well

Can you be specific with the snapshot version and where the setting is? I can't seem to find the setting.

However, changing the username back to admin fixed my issue so things are great again.

Thanks, great help.
For the next PFsenses I have already choosen a devices from:
http://www.applianceshop.eu/index.php/firewalls/opnsense/opnsense-rack/opnsense-hd-rack-edition-pfsense-appliance.html
Looks good, let's see if the have supported WLAN devices as well…

mc

Try tomorrows snapshot.

awesome…that worked perfectly. very cool. thank you.

As I've replaced hardware firewalls at remote sites with pfsense, I've moved tunnels from ipsec to openvpn. Both work well, but for me, every now and then I'd get ipsec tunnels that seemed to get out of sync, and refuse to connect for somewhat lengthy periods of time (anywhere from 10 minutes to a couple hours), to the point I'd have to reboot both boxes to force a connection. And no numbers to back it up, but openvpn tends to feel a little faster than ipsec - might be the compression that is enabled.

I concur igor.

That's fixed in RC3 and there aren't any known issues, you need to upgrade. If you have issues with RC3, post them.

There is a fix on 2.0 for this now.
Update to latest snapshot.

Seems like a memory issue.

Yeah i understand but seems rather strange to have that error with a san config.

I will put some checks to not bring out the warning, since its harmless.

It should be working in the version of pf we have on 2.0. It certainly did not work for 1.2.x though.

That said, using negation can usually be worked around by using two rules, a block and a pass, to achieve the same effect in a manner which is easier to read.

Upgrade to 2.0 :-)

ok updated to the latest build and cleared the graphs with the new button.

this has resulted in all the graphs working except the quality graphs

I was also getting the following errors:
php: /status_rrd_graph_img.php: Failed to create graph with error code 1, the error is: ERROR: No DS called 'inpass' in '/var/db/rrd/wan-traffic.rrd'/usr/bin/nice -n20 /usr/local/bin/rrdtool graph /tmp/wan-traffic.rrd-month.png –start 1308421501 --end 1311186301 --vertical-label "bits/sec" --color SHADEA#eeeeee --color SHADEB#eeeeee --title "hostname - WAN :: Traffic - 1 month - 1 hour average" --height 200 --width 620 DEF:wan-in_bytes_pass=/var/db/rrd/wan-traffic.rrd:inpass:AVERAGE DEF:wan-out_bytes_pass=/var/db/rrd/wan-traffic.rrd:outpass:AVERAGE DEF:wan-in_bytes_block=/var/db/rrd/wan-traffic.rrd:inblock:AVERAGE DEF:wan-out_bytes_block=/var/db/rrd/wan-traffic.rrd:outblock:AVERAGE CDEF:"wan-in_bits_pass=wan-in_bytes_pass,8," CDEF:"wan-out_bits_pass=wan-out_bytes_pass,8," CDEF:"wan-in_bits_block=wan-in_bytes_block,8," CDEF:"wan-out_bits_block=wan-out_bytes_block,8," CDEF:"wan-in_bytes=wan-in_bytes_pass,wan-in_bytes_block,+" CDEF:"wan-out_bytes=wan-out_bytes_pass,wan-out_bytes_block,

but now Jul 20 19:57:16 apinger: Error while feeding rrdtool: Broken pipe

well, this weird behaviour is kind of solved.
i recently got my hands on another huawei e220 and it worked out of the box. the difference was the firmware. while the slow one was x.116 the working one was x.117. a firmware flash later both work.

thanks for all the replies!!