SG-2100 MULTI-WAN CONFIGURATIONS
-
@stephenw10 I discovered something now. Even though the status message for OPT1 (used as secondary WAN) shows "Offline, Packetloss" (when I put Static IP4 config) or "Unknown" (when I put DHCP config), I can connect to the internet via OPT1 in both the cases.
I disabled the primary WAN interface just to make sure. I can connect to the internet via OPT1. Thanks for helping me explore this.
Now, if I can connect to the internet via OPT1, why am I getting "Offline, Packetloss" or "Unknown" on my pfSense Status Dashboard?
-
@skbnet What is set as the gateway monitoring IP for that interface? It’s probably not responding to pings. (Also, make it different than WAN)
-
@steveits When I disable gateway monitoring, I can see gateway status "Online" instead of "Offline, Packetloss". When I add google dns or my ISP gateway IP as a monitoring IP, it again shows "Offline, Packetloss"
I can live without monitoring IP for the secondary WAN but don't you think this will create problem when I configure load balancing/failover?
-
Yes, you need to have reliable gateway monitoring for failover.
If you can connect out to the internet via OPT1 you should be able to set, say, 8.8.8.8 as a monitoring IP there and see replies.
I assume you can ping 8.8.8.8 from a client behind the firewall when the main WAN is disconnected? Assuming you have setup some policy routing or failover system route.Can you ping the OPT1 gateway IP from a client behind the firewall?
Check the firewall states in Diag > States. Do you see the monitoring pings on the OPT1 interface.
We are probably going to need some screenshots to review here.
Steve
-
@stephenw10 I can ping 8.8.8.8 from a client behind the firewall when the main WAN is disconnected.
I can also ping the OPT1 gateway IP from a client behind the firewall. But when I put 8.8.8.8 as monitoring IP, I get the same "Offline, Packetloss" status.
I checked the states in Diag > States nad state for monitoring pings on the OPT1 is 0:0.
Should I hard reset and configure everything again? -
Are you policy routing traffic from the client via the OPT1 gateway when you do that?
Can you ping from the firewall itself either at the command line or from Diag > Ping?
-
@stephenw10 When I am trying to ping 8.8.8.8, I am disabling the primary WAN so that all my traffic goes via OPT1.
Yes, I can ping from the firewall itself from Diag > Ping via OPT1. -
Hmm, do you see the dpinger service running?
You should see a state on the OPT1 interface for the gateway monitoring pings even if it doesn't reply.
-
@stephenw10 Sorry, I have no idea about the dpinger service. Can you tell me how to check it?
-
Shown in Status > Services. You can try restarting it there too.
-
@stephenw10 Yes, dpinger service was running and restarted it. But still the same problem.
-
Mmm, I think we're going to need to see screenshots.
Something odd going on.
What states to you see on OPT1?
What states do you see for the monitoring IP you set on any interface?
-
@stephenw10
Screenshots attached for reference. -
@stephenw10 I solved this puzzle. There is no issue with SG-2100. It was the firewall setting of the upstream router which was blocking the monitoring. I changed those settings in the upstream router and now the interface status of OPT1 is "Online" with 8.8.8.8 as the monitoring IP.
Thanks a lot for your guidance.
-
Ah, good catch.
I was just going to suggest something must be blocking it upstream. Odd that you were able to ping 8.8.8.8 from a client on LAN though.
Steve
