Filter IPsec VTI and Transport on assigned interfaces, block all tunnel mode traffic
-
not sure if i found a bug or if this is the intended behavior. i think bug.
i switched my CE 2.7.2 HA Pair to use "Filter IPsec VTI and Transport on assigned interfaces, block all tunnel mode traffic" stead of the default of "Filter IPSec Tunnel, Transport, and VTI on IPSec tab (enc0)" which has always been the default as far as i can see.
when i made this change on the primary, this setting did not change on the HA secondary. i then set it by hand on the secondary.
both nodes now show VTI interface in the firewall rules page.
i began to create rules on the new VTI interface in the rules page of the primary, and the newly created rules did not replicate to the HA secondary.wondering if anyone else has seen this, or maybe might be able to replicate the behavior?
-
turns out, it was me. i mistakenly upgraded the secondary node to 2.7.2, but forgot to upgrade the primary node and it was still 2.7.0. HAsync was not working due to this error, so this was not a pfsense problem, it was a me problem :)