Thanks, I'll check out the NIC in the computer connected to this NIC.

lol Just press Enter for all computer related prompts until there are horrible errors, then pay attention. Good catch, NickM. :)

Look at firewall rules for each OPT interface.  The default "allow everything" rule is only put in place on the LAN interface.  Perhaps you haven't copied it to the OPT interfaces for the other vlans?  Check firewall logs.

@johnpoz: Derelict where are you seeing these /8 /16 and /32 masks.  I don't see that anywhere in the OP pics or comments? I updated them when I realized I made the typo. @johnpoz: What jumped out at me was his deny rules on WL saying can not go to dmz and lan but source is WAN net? Yep I saw that too and fixed that myself. facepalm @johnpoz: And not actually seeing the icon for the rule just his comments so who knows if they are allow or block or reject.  And those rules are all pointless putting a source of wan net on the WL interface. Agreed.. but in the end its working how i need it, so all is well in the world!

Thanks.  I did notice when I was testing on the bench that 2.2.1 would not sync to 2.0, citing the version mismatch.  Good to know whatever was broken is fixed. I'm fortunate that I'm usually the only one making changes so I can just leave it alone during an HA upgrade.

My point to be hard to believe is that without some interaction from your part I find it hard to believe that it would just change arch for no reason.  So something had to be done to have this happen.. Just clicking upgrade when it says there is an upgrade ready seems almost impossible that it would do the wrong arch. While its quite possible there is some issue in the allowing user to change arch and not being plainly obvious in the gui, etc. as dok has point out.  I still don't see how this could just happen on its own without any interaction from the user to mess it up.

Sounds like all you need to do is eliminate the HSRP IP address and put the two routers on different VANs/subnets. Make each router the default gateway for its subnet. Do you want each router to be a backup outbound path for the other? You'll need some policy based routing statements with SLAs attached.

Is the WAN port configured as DHCP? Did you try Status > Interfaces? DHCP Release/Renew button?

full

All well and nice but I have several pfSense boxes at several client locations and all work except one. I've checked and double checked each and every setting, deleted it and recreated it, but it still keeps saying 'Gateway authentication error' and 'invalid ID_V1 payload length, decryption failed?' after the upgrade to 2.2.4 (I skipped 2.2.3) To be precise, I copied the configuration from exact the same hardware appliance box, just to rule out hardware dependencies.

@mechrock: Have you been able to fix this? sadly, no. i am totally at a loss. dont know what to try

But you was not trying out the yellow SATA port, or? I would try it out once more again with a SSD or USB Memstick NanoBSD.

What box are you actually using? The BIOS you referenced is for an X-e box like the x750e. The X700 is not an X-e box. Steve

Had the same issues with 2.2.1 through 2.2.4.  Only swapping to a newer card fixed it.  Like I said, maybe forcing the loader to use a slower PIO mode may have worked, but I was having entering commands using the serial console (for some reason only with 2.2.x) and loading the image in vmware to save/restore configs was making the troubleshooting a hassle.

Two main causes: 1. Shoddy disk 2. Shoddy controller #1 can't be worked around, but #2 sometimes can: https://doc.pfsense.org/index.php/Boot_Troubleshooting#.22Fake.22_RAID_cards_with_a_GRAID_error Wiping the disk isn't a bad idea, quickest way is to let pfSense boot all the way up to the menu (may have to assign NICs first), drop to a shell and run: dd if=/dev/zero of=/dev/ada0 bs=1M count=1 A little more than needed, but quick and sure to get the job done. Also if your BIOS has any tweaks for the ATA controller, try toggling things like Legacy mode or AHCI, and a BIOS update isn't a bad idea. If there is a crappy soft RAID controller in the BIOS, disable it or set it for JBOD mode.

Why would you need a IP on your switch for every vlan?  Unless its L3 and you want to route on our switch?  Or you need a IP in that vlan on the switch to troubleshoot with.