Restoring an old 2.4.3 config to 24.11 is missing OpenVPN servers and CSO

[Rico]

Hi guys,

I'm trying to restore one of my old XG-7100 2.4.3 config files to a fresh 24.11 installation.
The restore completes without any errors but leaves me with an entirely empty section under VPN > OpenVPN > Servers and VPN > OpenVPN > Client Specific Overrides.

Any ideas?

-Rico

[stephenw10]

Only the CSOs are removed?

Any errors logged at import?

[Rico]

The OpenVPN servers and CSOs.
No errors in the log.
If I export a backup file again from the target firewall with OpenVPN missing the xml file is containing all the OpenVPN information, but nothing is shown in the WebGUI.

-Rico

[stephenw10]

Hmm, so the config sections still look good? Like they are unchanged from the 2.4.3 version?

Did you import the full config file?

[Rico]

Yes, they look completely unchanged from 2.4.3.

I imported the full backup file.

I just tried restoring only the OpenVPN section again, and now the entries appear in the WebGUI, but the OpenVPN service is offline.
I then edited and saved one of the OpenVPN servers, and now its service is running.

Is this the expected behavior due to significant parameter changes, or should the config import handle this automatically?
I’m still wondering why the full restore didn’t work—maybe there are other missing elements I haven’t noticed yet.

I’ll try a full restore on one of my 6100 units tomorrow. Hopefully, this works, especially considering the XG-7100 switch configuration…

-Rico

[stephenw10]

Yes there are a number of config upgrades that apply after 17.9:
https://github.com/pfsense/pfsense/blob/master/src/etc/inc/upgrade_config.inc#L5466

I'd be surprised if none applied to your config. It seems likely it failed to upgrade them for some reason.

[Rico]

For testing, I imported the full configuration file into CE 2.7.2, and it worked without any problems.
That corresponds to 23.09.1 right?

-Rico

[stephenw10]

It's the same config version, yes
https://docs.netgate.com/pfsense/en/latest/releases/versions.html

Do you have MIM enabled in 24.11?

[Rico]

I did not enable MIM, but I can check tomorrow when I'm on-site again. Could this prevent the config from being fully imported?
Unfortunately, I don't have a 23.09.1 image, only 23.09. Is this version still able to pull packages? I only need the OpenVPN client export, though.

-Rico

[stephenw10]

It's hard to imagine it would because we've been running here with OpenVPN for a long time but potentially it could create issues with what is shown in the gui. I don't think it would affect anything at import

[Rico]

After extensive testing, I can say that importing my config into 24.03 seems to work. From there, I can upgrade to 24.11.
However, importing the config directly into 24.11 does not work, even on my Netgate 6100.
I’m still wondering why it doesn’t show any errors and just skips parts.

-Rico

[stephenw10]

Can you compare the config after updating to 24.11 vs just importing directly?

[stephenw10]

Oh it's this: https://redmine.pfsense.org/issues/15895
There's a patch for it in the recommended patches list in the System Patches package in 24.11.

[Rico]

Argh, I searched the forum and Redmine but couldn't find anything regarding my problem.
Thank you very much for the clarification and your support, Stephen.
Anyway, I should be fine with jumping to 24.03 first and then to 24.11, right? :-)

-Rico

[stephenw10]

Yes, that should be fine.