Reproducible kernel panic with pfSense 2.2 and IPSEC

w0w

Ok… At least I'll give it a try. Later, next week maybe :)

georgeman

Still, do we have any clues on the issue itself? It affects Alix boards and similar hardware to at least some degree (besides some other reports, I had to downgrade some production boxes myself due to random reboots which I am sure are related to all this). Unfortunately I couldn't find a specific trigger but there seem to be several crash dumps and reproducible configs available

w0w

https://redmine.pfsense.org/issues/4454 Looks like something moving forward, at least for me, thanks for Chris Buechler

w0w

Ok, installed amd64, no more kernel panic when "Insert strong ID…" option enabled. So yes, I can confirm that x86 platform is affected and amd64 not.

eri--

Can you try to set net.inet.ipsec.directdispatch to 0 and see if the panic goes away?

flix87

Update my pfsense in lab on 2.2.1 same behavior
then i tried to

set net.inet.ipsec.directdispatch to 0

looks good so far. stable since about 30 minutes (before after about 30 seconds i get a kernel panic)

eri--

Can you describe your WAN interface?

flix87

in our lab i used 3 pfsenses

one so to say provider with an pppoe server (Version 2.2.1 Vmware)

then i have one pfsense which stands for my company firewall (Version 2.1.5 Vmware)

and i have another pfsense which stand for my home pfsense (Version 2.2.1 Alix2d3)

both pfsenses from company and home have a pppoe wan interface which is connected to my provider pfsense

on my home pfsense i also have a vlan tag added like i have to do it at my real home pfsense.

eri--

Ok there is an open issue for this scenario already.

Thank you for the information.

flix87

yes my scenario is like described befor in this thread.
but set net.inet.ipsec.directdispatch to 0 seems to "workaround" the issue
so there is may be hope for all 32 Bit Users ;)

w0w

ermal, do you need my report too? :)
Actually I am the man who reported the issue. But I moved my box on to amd64 version…
I ask because I have troubles to restoring old x86 backup, so new installation take time... I can do it but only if it really needed.

eri--

Nope the scenario is clear.

flix87

i can reproduce the scenario in our lab any time. The VM's are set up already just need to put back the config into the alix board.
If you need just let me know.

eeit

@flix87:

Update my pfsense in lab on 2.2.1 same behavior
then i tried to

set net.inet.ipsec.directdispatch to 0

looks good so far. stable since about 30 minutes (before after about 30 seconds i get a kernel panic)

Hello, had the same issues with reboot`s on 8 devices.

Hardware ALIX.2 v0.99m tinyBIOS V1.4a.
Pf.Version 2.2.2-RELEASE (i386) built on Mon Apr 13 20:10:33 CDT 2015.

After the set of "net.inet.ipsec.directdispatch to 0" all systems works fine. No reboots, no systempanics, stable 3 days ago yet. :)

What is done with this adjustment ? Will this fix embedded as standard for further versions ?

Best regards

eeit

sh0gun

net.inet.ipsec.directdispatch=0

fixes the issue on ALIX 2D13 (32bit) with IPSEC for me. Thank you very much! Marked as solved.

eri--

Can you please having issues with this confirm that you are running Proxy arps?
If yes, can you try with the fix at https://redmine.pfsense.org/issues/4685 last comment.

adelphi

@ermal:

Can you please having issues with this confirm that you are running Proxy arps?
If yes, can you try with the fix at https://redmine.pfsense.org/issues/4685 last comment.

I'm having the same issue (see https://forum.pfsense.org/index.php?topic=94140.0) and afaik i'm not using proxy arps. None of the previous tunables (including net.inet.ipsec.directdispatch=0) did fix it!

bab5470

I'm getting this error on my x86 pfsense box when booting up.

How can I set set net.inet.ipsec.directdispatch to 0?

I've connected a monitor and keyboard, booted up my system
Selected '3. Escape to loader prompt.'
I type:: 'set net.inet.ipsec.directdispatch=0'
Then type: 'boot'

I get the same kernel panic? Am I doing this wrong? Can anyone help me? :)

Thanks,
Brad

cmb

@bab5470:

I'm getting this error on my x86 pfsense box when booting up.

Just make sure you're running 2.2.4, that's been fixed in 2.2.3 and newer. directdispatch is automatically set accordingly for 32 bit to avoid that crash. If you're already on 2.2.4, then you have a different problem, start a new thread detailing what you're seeing.

bab5470

How can I upgrade if I can't even boot up the box though? I assume I could re-install from scratch but I don't really want to lose all my settings.