It seems thats the problem - it does not like samsung sticks. Switched to ALOT slower Kingston ones and it works and boots every time. I even cloned the kingston ones to samsung thinking that it's the uefi or some other things that is broken. It just boots from cold boot once and after reboots usb is not working and not booting. Sad thing is kingston ones are so slow for the same money and don't know how pricey i have to go to get decent performance out of them.

Unfortunately I am back on this issue when updating another firewall in that offline network. Rebooting the firewall after the update did not help to fix the issue this time. Trying to debug this further I tried to call fetch manually: [2.5.1-RELEASE][admin@...]/root: fetch -v http://10.x.x.x/pfsense/pfSense_v2_5_1_amd64-core/packagesite.txz resolving server address: 10.x.x.x:80 requesting http://10.x.x.x/pfsense/pfSense_v2_5_1_amd64-core/packagesite.txz It just hangs, same as when I call pkg-static update manually. But if I do the same fetch on meta.conf it loads perfectly fine: [2.5.1-RELEASE][admin@...]/root: fetch -v http://10.x.x.x/pfsense/pfSense_v2_5_1_amd64-core/meta.conf resolving server address: 10.x.x.x:80 requesting http://10.x.x.x/pfsense/pfSense_v2_5_1_amd64-core/meta.conf remote size / mtime: 163 / 1618334907 meta.conf 163 B 449 kBps 00s

@steveits yes, i assumed that. I keep my setup on the latest stable releases of pfsense and packages, so that's not an issue. I'd make sure all were on the latest before doing the config backup and restore. this is good! saves me a TON of time... Thanks!

I don't have any 5100's, but every single 3100 I have (I think 14 online at the moment) has bricked on pfSense+ major and minor updates, plus major rule rewrites were required after restore on the initial pfSense+ update for several.

@vmb said in No packages after restore: So, if you are reading this and you prefer to only use the stable releases, thank you for supporting pfSense and giving it the good reputation it has. It is difficult to argue with this, as there are two sides to the coin. (Natgate will not let such a grossly inoperable version out of its hands - Okay - good, 2.5.0, we also avoided it, far away) But thank you for sharing your opinion with us. About old ISO images and offline installation: Otherwise, you can simply not delete the old_pfs_x_y_z.iso (of course whatever is current at the time) from the pendrive (or etc.) and save it to the deepest folders of your NAS and install it offline, whenever you feel like it. BTW: and you don't have to claim this from Netgate

@mpetts1 @gertjan Solved this in the end. Removed the WAN Gateway and re-added. Same info as before, just works this time! Thank you for your help.

Send email to support.. They will help you out. No support contract needed for images for netgate hardware I have a sg-4860 desktop model, and get new image every time new one comes out. To have on hand.

Ok, so you have both outbound policy routing and a port forward in the other direction. So the IPSec tunnel can establish in either direction. Which way does it actually establish? Both? Is it failing to establish at all in 2.5.2? I would not expect to require both those. Certainly the tunnel will only use one to create the states though it could use either if it's a site to site tunnel. If it's actually blocking traffic what do the firewall logs look like? What rule is blocking? Check the state table. Do you see states on the wrong interfaces? Steve

If you previously had a geom mirror on there you probably have to destroy it first. But disable the hardware raid stuff first.

@mer The only reason I suggested this was I ran into a similar issue a few weeks ago on an SG-2100 and I've also seen it reported for the SG-1100. I don't know if it's an aarch64 specific issue or not.

So I'm upgrading again today from 21.02 to 21.05 and I'm having this issue again. I'm actually pretty confident this has happened every time I upgrade this box from the GUI. Has there really been no one else having this issue?

@fsc830 Packages can't fully reinstall if the boot after the main image upgrade fails. This was my problem after the 21.02 to 21.02.2 upgrade. The firmware update applied BUT then the firewall core dumped and it never got to the point that packed would auto update. I had to disable PFB and reboot for the packages to update. The root cause of all this instability is the PHP bug apparently and the patch provided is not a long-term solution but a temp workaround.

Well that was strange... On the SG-1100, I reviewed the IPSEC VPN config and it all looked right, but the tunnel still wouldn't come up. So, I just re-saved the phase 1 and phase 2 configs and then the tunnel came up. The moral of the story is: power cycle before applying this update and be ready to kick your IPSEC VPN.

@steveits I have a Teamviewer connection to a pc on the network the pfsense box resides. i can hit the web gui or ssh from there. That's it...

That was the issue.

Now I know I'm not crazy. I have my FW on a Virtualbox VM with an Immutable disk, last time I was on site I tried updating to 2.5.0 and something went wrong, it froze, so I manually restarted it, the thing is, it seems I forgot to set the drive to Immutable time ago, but it still stayed at 2.4.5_p1 after the update failed. Time went by and last week I started having VPN issues. I've logged in to check, and it was updated to 2.5.1! I had to get an image when it was 2.4.4 set to update to the DEPRECATED channel, updated to 2.4.5_p1 and set it to immutable. Let's see what happens.

@kom Indeed I agree Kom. There is a site wide network infrastructure upgrade about to commence and I will add the UPS requirement into those works. Thanks again for your input. Take care.

@jknott said in 2.4.5p1 ISO too large for CD: @rosmaniac Are there any computers that can't boot from USB, but can still run a current version of pfsense? Yes, the Dell SC1425 I'm working on has trouble with USB booting and only has a CD drive. Fully 64-bit, even though it's old.