Ping to WAN or LAN fails (pfsense 2.3)

johnpoz

"then I pinged 192.168.10.1 on the firewall and that failed."

You mean pfsense could not ping its own interface?

Looks like something changed and your openvpn reset? You have gateways on your lan??

"Reloading endpoints that may use LANGTW."

So there are downstream networks from pfsense? Could draw out your network?

Gadmin

Gateways:
Name Gateway Monitor RTT RTTsd Loss Status Description
WANGW 62.58.41.65 8.8.8.8 9.658ms 1.333ms 0.0% Online WAN Gateway
LANGTW 192.168.1.253 192.168.1.253 0.586ms 0.333ms 0.0% Online Main Switch
CiscoVPN 192.168.1.248 192.168.1.248 0.736ms 0.205ms 0.0% Online Cisco ASA 5505 MR

Static Routes:

192.168.10.0/24 LANGTW - 192.168.1.253 LAN Office Subnet
192.168.160.0/24 CiscoVPN - 192.168.1.248 LAN VPN Australia
192.168.20.0/24 LANGTW - 192.168.1.253 LAN DTP Subnet
192.168.30.0/23 LANGTW - 192.168.1.253 LAN R&D Subnet
192.168.40.0/24 LANGTW - 192.168.1.253 LAN Production Subnet
192.168.50.0/24 CiscoVPN - 192.168.1.248 LAN MR systems Subnet
192.168.60.0/24 LANGTW - 192.168.1.253 LAN Overige Subnet
192.168.70.0/24 CiscoVPN - 192.168.1.248 LAN VPN Clients Subnet

The openvpn server is disabled.

Apr 29 11:20:19	dpinger		send_interval 500ms loss_interval 2000ms time_period 60000ms report_interval 0ms data_len 1 alert_interval 1000ms latency_alarm 500ms loss_alarm 20% dest_addr 192.168.1.248 bind_addr 192.168.1.101 identifier "CiscoVPN "
Apr 29 11:20:19	dpinger		send_interval 500ms loss_interval 2000ms time_period 60000ms report_interval 0ms data_len 1 alert_interval 1000ms latency_alarm 500ms loss_alarm 20% dest_addr 192.168.1.253 bind_addr 192.168.1.101 identifier "LANGTW "
Apr 29 11:20:19	dpinger		send_interval 500ms loss_interval 2000ms time_period 60000ms report_interval 0ms data_len 1 alert_interval 1000ms latency_alarm 500ms loss_alarm 20% dest_addr 8.8.8.8 bind_addr 62.58.41.67 identifier "WANGW "
Apr 29 10:43:16	dpinger		CiscoVPN 192.168.1.248: Clear latency 729us stddev 198us loss 5%
Apr 29 10:43:16	dpinger		LANGTW 192.168.1.253: Clear latency 564us stddev 270us loss 5%
Apr 29 10:43:15	dpinger		WANGW 8.8.8.8: Clear latency 9368us stddev 621us loss 5%

johnpoz

Why do you have a LAN GW?? So all these networks are down stream?

and you also have a vpn connection over the same network??

Gadmin

Sorry, but I don't know. As I said I'm new with this and the FW was already configured before I worked with this.

johnpoz

so can pfsense ping its gateways to get to these other networks when they go down??

192.168.1.253 seems to be the gateway to get to these network.. What is that device?

192.168.20.0/24 LANGTW - 192.168.1.253 LAN DTP Subnet
192.168.30.0/23 LANGTW - 192.168.1.253 LAN R&D Subnet
192.168.40.0/24 LANGTW - 192.168.1.253 LAN Production Subnet

And seems you also have carp setup?

carp: VHID 3@em2: BACKUP -> MASTER (preempting a slower master)
carp: VHID 2@em0: BACKUP -> MASTER (master down)
carp: VHID 1@em1: BACKUP -> MASTER (master down)

Your really going to have to draw up this network if your wanting help.. Looks like you also have loss on your network

Apr 29 10:43:16 dpinger LANGTW 192.168.1.253: Clear latency 564us stddev 270us loss 5%

So your rebooting pfsense when it can not get somewhere, or your rebooting some other server when it can not talk to pfsense?

Gadmin

The 192.168.1.253 is the main Switch. So every switch is connected to that one and the main switch is connected to both the firewalls.

We have 2 Firewalls if the first reboots or turns off the second firewall will be the MASTER.

Yes, I'm rebooting the first firewall when it cannot ping 8.8.8.8 or one of the subnets.

cmb

Are you using IPsec?

johnpoz

You sure about that? This seems to indicate that your master is down

carp: VHID 1@em1: BACKUP -> MASTER (master down)

Is that off the pfsense that you didn't reboot?

First thing I would suggest vs rebooting.. Is actually look to why it can not talk to whatever.. What are the errors in the log when it can not talk.. In carp setup it should failover if there is an issue with it, etc.. So sounds like you have a problem with carp not working as well.

Gadmin

Yes, I'm using upsec. See attachment

Ipsec.png_thumb
![Ipsec rules.png](/public/imported_attachments/1/Ipsec rules.png)
![Ipsec rules.png_thumb](/public/imported_attachments/1/Ipsec rules.png_thumb)

Gadmin

It is off the pfsense that I rebooted.

And I think your right about the CARP. The second firewall only takes over if the first firewall turns off or reboots.

cmb

Guessing you're hitting the issue described here.
https://forum.pfsense.org/index.php?topic=110710.msg618388#msg618388

which we're working on tracking down. The workaround there should suffice in the mean time for the few who are routinely hitting that.

Gadmin

I see that 2.3.1 is released. Will this update solve the problem that we have to run on 1 cpu core to ensure internet connection?

cmb

@Gadmin:

I see that 2.3.1 is released. Will this update solve the problem

Yes, 2.3.1 and newer fix that issue.