Send email to support.. They will help you out. No support contract needed for images for netgate hardware I have a sg-4860 desktop model, and get new image every time new one comes out. To have on hand.

Ok, so you have both outbound policy routing and a port forward in the other direction. So the IPSec tunnel can establish in either direction. Which way does it actually establish? Both? Is it failing to establish at all in 2.5.2? I would not expect to require both those. Certainly the tunnel will only use one to create the states though it could use either if it's a site to site tunnel. If it's actually blocking traffic what do the firewall logs look like? What rule is blocking? Check the state table. Do you see states on the wrong interfaces? Steve

If you previously had a geom mirror on there you probably have to destroy it first. But disable the hardware raid stuff first.

@mer The only reason I suggested this was I ran into a similar issue a few weeks ago on an SG-2100 and I've also seen it reported for the SG-1100. I don't know if it's an aarch64 specific issue or not.

So I'm upgrading again today from 21.02 to 21.05 and I'm having this issue again. I'm actually pretty confident this has happened every time I upgrade this box from the GUI. Has there really been no one else having this issue?

@fsc830 Packages can't fully reinstall if the boot after the main image upgrade fails. This was my problem after the 21.02 to 21.02.2 upgrade. The firmware update applied BUT then the firewall core dumped and it never got to the point that packed would auto update. I had to disable PFB and reboot for the packages to update. The root cause of all this instability is the PHP bug apparently and the patch provided is not a long-term solution but a temp workaround.

Well that was strange... On the SG-1100, I reviewed the IPSEC VPN config and it all looked right, but the tunnel still wouldn't come up. So, I just re-saved the phase 1 and phase 2 configs and then the tunnel came up. The moral of the story is: power cycle before applying this update and be ready to kick your IPSEC VPN.

@steveits I have a Teamviewer connection to a pc on the network the pfsense box resides. i can hit the web gui or ssh from there. That's it...

That was the issue.

Now I know I'm not crazy. I have my FW on a Virtualbox VM with an Immutable disk, last time I was on site I tried updating to 2.5.0 and something went wrong, it froze, so I manually restarted it, the thing is, it seems I forgot to set the drive to Immutable time ago, but it still stayed at 2.4.5_p1 after the update failed. Time went by and last week I started having VPN issues. I've logged in to check, and it was updated to 2.5.1! I had to get an image when it was 2.4.4 set to update to the DEPRECATED channel, updated to 2.4.5_p1 and set it to immutable. Let's see what happens.

@kom Indeed I agree Kom. There is a site wide network infrastructure upgrade about to commence and I will add the UPS requirement into those works. Thanks again for your input. Take care.

@jknott said in 2.4.5p1 ISO too large for CD: @rosmaniac Are there any computers that can't boot from USB, but can still run a current version of pfsense? Yes, the Dell SC1425 I'm working on has trouble with USB booting and only has a CD drive. Fully 64-bit, even though it's old.

@stephenw10 That is such awesome news! Thank you for answering my question. I look forward to being able to migrate to pfSense Plus. :) Thanks again Stephenw10.

Yup upgrading at the console will give you far more error output. You can also try running pkg -d update. That will show even more error output if there are issues reaching the update repo. Steve

It's hard to recommend using Rufus, I've seen that fail many times. Usually because it's not being used in bit-for-bit mode (dd). I would always use Etcher which only writes full images and is available for, almost, any OS. Steve

Nice find! That seems to have resurrected my XTM800 too. There are fan control values in the BIOS. It doesn't go super quiet though, it's a power hungry box. WGXepc should detect the hardware but I never found a way to set the LED on that board (despite looking for a long time!) and the fan control in the BIOS was 'good enough' for me. You do need a VGA console to access it though which is a PITA. Might be possible to add it. Steve

@steveits I didn't see that, will take a look, thank you very much.

After a discussion with support I decided my new upgrade procedure will be: Download img for current install version (if I don't already have it). Download img for new release. Backup my config. Run the upgrade from the console. If it is successful -> done If it fails install the img from the new release with the retain config option. If the new img is successful but the config failed restore the config from backup. If the new img install fails do #6/7 using the old img. Determining what is successful can be subjective or could take a while to realize. Fortunately our firewall configuration is somewhat static so we can run on a new release for a while and still roll back relatively easily. For major releases (21.02) I'm leaning towards going directly to a img install on those.

@jared-busch said in Downgrade to 2.5.0: Great, they have it, but nothing on that screen shows anything related to older versions. Who, besides you, wastes time clicking around on unrelated links? I would guess any "Linux Professional" would use that URL to get a shasum file to verify the download. On linux the file is easy to use for veriify. Curiosity doesn't just kill cats , it can also expand your knowledge.