I download to download a copy of "pfSense 2.4.2-RELEASE-p1"
-
@nimrod said in I download to download a copy of "pfSense 2.4.2-RELEASE-p1":
Waste of time. Just save your current configuration, download latest ISO, perform clean install, and restore. Minor changes can be adjusted manually.
So, with a smile and a nod, let's embrace the silliness of the original question, I shall continue my exploration
Thank you, kind sir.
-
@ipguy said in I download to download a copy of "pfSense 2.4.2-RELEASE-p1":
one must traverse the realm of upgrades step by step, ascending the ladder of versions
Nope - while some software might require intermediate steps to get from A - Z.. Not with pfsense - just jump to the current..
So your saying your currently running older than 2.4.2? WTF dude really - 2.4.2 like I said is like 6 years old.. a There might be something said about not rushing into the latest and greatest release put out..
I never understand how someone could let their "firewall" fall so far behind current. Hey if you were on 22.05 understandable.. Shoot if you were on 2.4.4p3 you could maybe use covid as your excuse for being behind ;)
-
Dude, I inherited the firewall, it's now my problem.
Look, I get it. You're clearly frustrated that it's not up-to-date with the latest version. But seriously, is it really necessary to be so condescending about it?
-
@ipguy said in I download to download a copy of "pfSense 2.4.2-RELEASE-p1":
it's now my problem.
Then take them to current.. Why do you think you need some 6 year old copy of pfsense, liked your prose and all - but still haven't really answered the why you think you need to take steps to move from where your at to current.
Grab the lastest CE version if on whitebox hardware, if your on netgate appliances - contact tac and they will send you the current + version..
If you explained why you think you need to stop at G on your way from A to Z.. we could maybe alleviate your fears?
Grab a copy of your current config.. Grab a copy of current install.. Click upgrade on the device, in a worse case if it fails you can install clean and then restore you config.. The process should really only take a few minutes.
Didn't mean to sound condescending.. Maybe if you would of started out your thread with hey, I took over some really old pfsense on xyz version, can I go straight to current version, or do I need to do intermediate we wouldn't be curious on why your so far behind, etc. And could go over that you don't need to stop at versions between, etc.
edit: if you took over this setup, and the devices are running some version that is 6 years or older even - its prob time to just upgrade the hardware as well ;)
Get some new hardware, install current move your config over to them.. and bobs your uncle.
-
With all due respect, i think this is one of those users that is absolutely convinced that the only way to solve this issue is their own way. There is no other way
-
@johnpoz said in I download to download a copy of "pfSense 2.4.2-RELEASE-p1":
edit: if you took over this setup, and the devices are running some version that is 6 years or older even - its prob time to just upgrade the hardware as well ;)
The migration to the new server is successfully accomplished, save for a couple of troublesome elements: the aging CA and Server CRT certificates that are on the brink of expiration.
The issue lies in the fact that the migration process to the new server and the renewal of the Server CRT are causing issues for remote devices in the field. The devices are rejecting the renewed Server CRT.
The old CRT's are working as expected on the new server, but the renewed server CRT is not.
-
@ipguy said in I download to download a copy of "pfSense 2.4.2-RELEASE-p1":
The old CRT's are working as expected on the new server, but the renewed server CRT is not.
What does that have to do with anything? You understand there have been some major changes in openvpn from 6 years ago.. There might be some stuff you have to alter in a 6 year old config.
CA and the certs - if they are not actually expired as of yet has nothing to do with it.. If you are updating pfsense to current, prob be a good time to create new CA and certs that is for sure. 6 years ago they most likely were not using current settings for CA and certs.. I would prob use ECDSA certs now vs RSA, etc. Prob digest is sha1 from that long ago, etc.
It prob a good time to also go over the complete openvpn configuration - make sure settings are in line with current best practice.. Making sure compress is off is one that comes to mind. Ciphers for sure should be looked at from such an old config. I believe something has change in the topology settings as well.. Prob want to make sure your using ncp now, etc.
Prob good to just start from scratch in your openvpn config to be honest.
-
OK, let's cut to the case.
If you were in my shoes what would you do if you had >10k mobile device in the field with CRTs that will expire in 6 months?
-
@ipguy Get started now ;) heheheh Make that 6 months ago..
Without some details its hard to say to be honest.. I don't even know if I would use pfsense if had 10k some remote devices trying to vpn in..
Management of certs for that many devices is no small feat.. Openvpn in pfsense might not be the best choice from a management stand point. Your going to have to do some heavy lifting most likely.
Are they these all company controlled laptops (windows?) Are they byod, are there other device types like phones or tablets involved?
Managing that many remote devices for vpn is not your typical scenario for openvpn on pfsense would be my gut reaction..
Are these devices that come into the office now and then, or are they 100% remote workers? Where you could push new vpn stuff while they are on prem, or do you need to update them all remotely while they are connected to the vpn, etc.
-
LOL
Pfsense works perfectly well with that number, no issues at all
More than 10K modems, each modem has a unique username and password but they all share/use the same server CRT
-
@ipguy said in I download to download a copy of "pfSense 2.4.2-RELEASE-p1":
Pfsense works perfectly well with that number, no issues at all
Not saying it wouldn't work ;) What I am saying is the management of the certs for the clients could be a lot of heavy lifting ;)
Not using client certs makes it easier to manage.. How long was the original CA set for.. I never make a CA less than 10 years myself..
Getting the devices a new CA prob going to be painful..
-
Really the only reason to want that installer version would be to recover back to that version because you know that works. Which is not unreasonable IMO.
But otherwise you can import the config from 2.4.2p1 directly into 2.6 as others have said. I would at least try that as a test.
Steve
-
As mentioned earlier, I inherited this problem.
The new server has been successfully set up, thoroughly tested, and validated.
I have successfully transferred the CA (Certificate Authority) and CRTs (certificates) from the "old server" to the new one, ensuring seamless connectivity for remote modems.
Currently, I am facing a challenge related to CA/CRT renewal. I am exploring possibilities to avoid the need for updating CRTs on thousands of modems. My objective is to determine if there is a solution to update the CA/CRT without extensive updates required on the modems.
-
@ipguy what does that have to do with 2.4.2 version - I am confused to what that would get you?
-
@johnpoz said in I download to download a copy of "pfSense 2.4.2-RELEASE-p1":
what does that have to do with 2.4.2 version
I guess the intention was do the migration 1 step at a time
- Upgrade hardware but keep old software & configuration
- Upgrade software.
@ipguy said in I download to download a copy of "pfSense 2.4.2-RELEASE-p1":
The migration to the new server is successfully accomplished, save for a couple of troublesome elements
Sound like gave up and did the hardware and software migration in one step.
-
Both servers are currently operational, and I have the ability to route traffic from the remote appliances to either one. The remote appliances (modems) are connecting without issue, primarily due to the utilization of the existing CA/CRT (which is set to expire in 6 months).
My objective is to determine if it's feasible to "renew" the expiring CRT and utilize it on the new server, which is running the latest version of pfSense, without requiring CRT updates on the remote appliances (modems) that are currently in production.
I would greatly appreciate any insights or advice regarding the possibility of achieving this goal. However, if it turns out that updating thousands of CRTs on the remote production appliances is the only viable solution, I will proceed accordingly. Nonetheless, I'm exploring alternatives to avoid this scenario if possible.
-
SHA256 (pfSense-netgate-memstick-2.4.2-RELEASE-p1-amd64.img.gz) = fa77c20d0d7582470cfaf1bd0ee4b64b350ef36c678d4121c5ba68385fa994e3Is this what you are searching for?
-Rico
-
@ipguy said in I download to download a copy of "pfSense 2.4.2-RELEASE-p1":
My objective is to determine if it's feasible to "renew" the expiring CRT
Problem is if the CA is expiring - the modems copy of that CA will not be renewed.. And they will not trust the renewed cert once their copy of the CA expires.. You need to update the CA on the modem so it will trust your cert that has been renewed.
There is really no point in "renewing" the old CA.. You should just create a new one.. With a new server cert off this CA.. The problem is getting the new CA to the remote boxes.
Since your not using client certs you don't have to reissue 10k certs.. You just need the remote devices to get the new CA, so then you can issue a new server cert via this new CA. That they will trust.
One way to combat this problem, is use of multiple CAs - If your CA has a life of 10 years, this should be longer then the life of the deployed remote device.. You would as the CA and certs be it server and or client, once the CA is say over 1 year old and you are going to deploy new devices you would use a different CA for these devices as they get deployed. Now any remote device should be good for the 10 years..
The heavy lifting part is going to be getting the new CA to your 10k remote devices.
-
Thank you for your clear and concise answer
-
@johnpoz said in I download to download a copy of "pfSense 2.4.2-RELEASE-p1":
One way to combat this problem, is use of multiple CAs - If your CA has a life of 10 years, this should be longer then the life of the deployed remote device.. You would as the CA and certs be it server and or client, once the CA is say over 1 year old and you are going to deploy new devices you would use a different CA for these devices as they get deployed. Now any remote device should be good for the 10 years..
I've explored some aspects of CAs and CRTs before, but this experience is taking me into much deeper territory.
I may be mistaken but by the looks of the "-text -noout" of the CRT currently in use on the remote modems, see below
Certificate: Data: Version: 3 (0x2) Serial Number: 0 (0x0) Signature Algorithm: sha256WithRSAEncryption Issuer: C=MARS, ST=NYC, L=London, O=thanos/emailAddress=ca@network.thanos.com, CN=thanos-ca.network Validity Not Before: Jan 19 22:34:22 2014 GMT Not After : Jan 17 22:34:22 2024 GMT Subject: C=MARS, ST=NYC, L=London, O=thanos/emailAddress=ca@network.thanos.com, CN=thanos-ca.network Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public-Key: (2048 bit) Modulus: 00:f4:94:86:07:f8:d7:dc:ef:ac:6a:cc:a2:c2:28: ... ... ... ... 0d:1c:79:e8:66:b1:bf:12:2c:50:2e:12:5b:e1:f7: 6a:93 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: 58:E0:8B:60:1C:A9:61:92:CA:57:5C:53:8C:99:12:96:03:99:B0:91 X509v3 MARSthority Key Identifier: keyid:58:E0:8B:60:1C:A9:61:92:CA:57:5C:53:8C:99:12:96:03:99:B0:91 DirName:/C=MARS/ST=NYC/L=London/O=thanos/emailAddress=ca@network.thanos.com/CN=thanos-ca.network serial:00 X509v3 Basic Constraints: CA:TRUE Signature Algorithm: sha256WithRSAEncryption 2f:c8:26:32:25:29:af:37:05:b2:04:cd:80:a2:9f:3d:72:84: ... ... ... ... 30:c9:c4:a7:b6:53:7f:d4:8b:be:38:13:10:09:85:f0:af:dc: 64:18:b2:02The modem's are using a client CRT and a CA ?
Or am I mistaken ?
