Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    FRR seeing IPsec tunnels disappearing

    Scheduled Pinned Locked Moved General pfSense Questions
    29 Posts 5 Posters 1.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      michmoor LAYER 8 Rebel Alliance @stephenw10
      last edited by michmoor

      @stephenw10

      I believe it does. For both incidents. Even though the time between a change of IP and the restart are a few minutes apart so it doesn't seem to occur right away.

      Incident one. Time of restart event was around 09:38

      ./pfblockerng/dns_reply.log:DNS-reply,Oct 7 09:32:25,resolver,A,A,300,vpn.server4u.in,127.0.0.1,124.123.66.69,IN
      ./pfblockerng/dns_reply.log:DNS-reply,Oct 7 09:37:25,resolver,A,A,300,vpn.server4u.in,127.0.0.1,103.127.188.125,IN
      ./pfblockerng/dns_reply.log:DNS-reply,Oct 7 09:42:41,resolver,A,A,300,vpn.server4u.in,127.0.0.1,124.123.66.69,IN
      

      Incident two: 14:18

      ./dns_reply.log:DNS-reply,Oct 7 14:14:03,resolver,A,A,300,vpn.networkzz.co.in,127.0.0.1,210.89.55.63,IN  <---
      ./dns_reply.log:DNS-reply,Oct 7 14:18:33,resolver,A,A,300,vpn.networkzz.co.in,127.0.0.1,202.88.209.151,IN
      

      Im happy that we found something that is reproducable.

      Firewall: NetGate,Palo Alto-VM,Juniper SRX
      Routing: Juniper, Arista, Cisco
      Switching: Juniper, Arista, Cisco
      Wireless: Unifi, Aruba IAP
      JNCIP,CCNP Enterprise

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        Hmm, OK so did those endpoints actually change? Are they FQDNs that resolve to several IPs?

        I'd guess there is some timeout there that has to add-up over those 4mins.

        Either way I agree it should not affect all IPSec tunnels.

        M 1 Reply Last reply Reply Quote 0
        • M
          michmoor LAYER 8 Rebel Alliance @stephenw10
          last edited by

          @stephenw10 said in FRR seeing IPsec tunnels disappearing:

          Hmm, OK so did those endpoints actually change? Are they FQDNs that resolve to several IPs?

          Yep those endpoints do resolve to several IPs. One of those i know for sure because i remember the set up for that recently.

          I did open the redmine for it for tracking purposes. Dont think there is any workaround for this other than getting into the weeds of how IPsec is configured/built

          Firewall: NetGate,Palo Alto-VM,Juniper SRX
          Routing: Juniper, Arista, Cisco
          Switching: Juniper, Arista, Cisco
          Wireless: Unifi, Aruba IAP
          JNCIP,CCNP Enterprise

          T 1 Reply Last reply Reply Quote 0
          • T
            tedquade @michmoor
            last edited by

            @michmoor "...getting into the weeds..."

            I love that!

            Ted

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Hmm, do they all resolve IPs? Conversely do you have any that only resolve to one IP that doesn't cause this?

              Like is this being triggered because it's resolving a different IP address everytime or just because it is re-resolving at all?

              M 1 Reply Last reply Reply Quote 0
              • M
                michmoor LAYER 8 Rebel Alliance @stephenw10
                last edited by

                @stephenw10 said in FRR seeing IPsec tunnels disappearing:

                do they all resolve IPs? Converse

                I have a few IPsec tunnels that are by IP only. I suspect this is being caused every time the it detects a change in the IP when pfsense goes to resolve the name.

                Firewall: NetGate,Palo Alto-VM,Juniper SRX
                Routing: Juniper, Arista, Cisco
                Switching: Juniper, Arista, Cisco
                Wireless: Unifi, Aruba IAP
                JNCIP,CCNP Enterprise

                1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  Yup. Are you able to test that by adding a host override so it always resolves to the same IP?

                  M 1 Reply Last reply Reply Quote 0
                  • M
                    michmoor LAYER 8 Rebel Alliance @stephenw10
                    last edited by

                    @stephenw10 that’s a good idea. Setting up one now. I’ll observe overnight maybe for a few days.

                    Have you discussed this internally?

                    Firewall: NetGate,Palo Alto-VM,Juniper SRX
                    Routing: Juniper, Arista, Cisco
                    Switching: Juniper, Arista, Cisco
                    Wireless: Unifi, Aruba IAP
                    JNCIP,CCNP Enterprise

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by

                      Yes, I think we've looked at this from other angles before. Just trying to pin down what's happening. I suspect there are several things open with the same root cause here.

                      M 2 Replies Last reply Reply Quote 1
                      • M
                        michmoor LAYER 8 Rebel Alliance @stephenw10
                        last edited by michmoor

                        @stephenw10

                        Lets give it two days or so. Searching on events /rc.newipsecdns: IPSEC: i noticed that this occurs either every day or every two days. I think we should know if the host override solves this problem by Wednesday

                        5770659c-77a7-4193-899e-238be8be90d1-image.png

                        Firewall: NetGate,Palo Alto-VM,Juniper SRX
                        Routing: Juniper, Arista, Cisco
                        Switching: Juniper, Arista, Cisco
                        Wireless: Unifi, Aruba IAP
                        JNCIP,CCNP Enterprise

                        M 1 Reply Last reply Reply Quote 1
                        • M
                          mcury @michmoor
                          last edited by

                          Watching this topic closely, I'm also seeing this behavior.
                          It seems that BGP plays nicer with Ignore IPsec Restart option than OSPF.

                          dead on arrival, nowhere to be found.

                          1 Reply Last reply Reply Quote 0
                          • M
                            michmoor LAYER 8 Rebel Alliance @stephenw10
                            last edited by

                            @stephenw10 I monitored the dns change separately and although it did change because the host override is there the IPsec tunnels never bounced.
                            It's safe to say the host override suggestion worked.

                            That said, i would like to go back to using DNS for this. What are the next steps to get a fix?

                            Firewall: NetGate,Palo Alto-VM,Juniper SRX
                            Routing: Juniper, Arista, Cisco
                            Switching: Juniper, Arista, Cisco
                            Wireless: Unifi, Aruba IAP
                            JNCIP,CCNP Enterprise

                            1 Reply Last reply Reply Quote 0
                            • M
                              marcosm Netgate
                              last edited by

                              This could certainly be handled better. I don't think there's anything else you need to do, though any further details are welcomed. I'll try to take a closer look at this, but it will likely be some time.

                              M 1 Reply Last reply Reply Quote 1
                              • M
                                michmoor LAYER 8 Rebel Alliance @marcosm
                                last edited by

                                @marcosm

                                https://redmine.pfsense.org/issues/15769

                                Thanks Marcos.

                                Firewall: NetGate,Palo Alto-VM,Juniper SRX
                                Routing: Juniper, Arista, Cisco
                                Switching: Juniper, Arista, Cisco
                                Wireless: Unifi, Aruba IAP
                                JNCIP,CCNP Enterprise

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.