Ping to WAN or LAN fails (pfsense 2.3)

johnpoz

Why do you have a LAN GW?? So all these networks are down stream?

and you also have a vpn connection over the same network??

Gadmin

Sorry, but I don't know. As I said I'm new with this and the FW was already configured before I worked with this.

johnpoz

so can pfsense ping its gateways to get to these other networks when they go down??

192.168.1.253 seems to be the gateway to get to these network.. What is that device?

192.168.20.0/24 LANGTW - 192.168.1.253 LAN DTP Subnet
192.168.30.0/23 LANGTW - 192.168.1.253 LAN R&D Subnet
192.168.40.0/24 LANGTW - 192.168.1.253 LAN Production Subnet

And seems you also have carp setup?

carp: VHID 3@em2: BACKUP -> MASTER (preempting a slower master)
carp: VHID 2@em0: BACKUP -> MASTER (master down)
carp: VHID 1@em1: BACKUP -> MASTER (master down)

Your really going to have to draw up this network if your wanting help.. Looks like you also have loss on your network

Apr 29 10:43:16 dpinger LANGTW 192.168.1.253: Clear latency 564us stddev 270us loss 5%

So your rebooting pfsense when it can not get somewhere, or your rebooting some other server when it can not talk to pfsense?

Gadmin

The 192.168.1.253 is the main Switch. So every switch is connected to that one and the main switch is connected to both the firewalls.

We have 2 Firewalls if the first reboots or turns off the second firewall will be the MASTER.

Yes, I'm rebooting the first firewall when it cannot ping 8.8.8.8 or one of the subnets.

cmb

Are you using IPsec?

johnpoz

You sure about that? This seems to indicate that your master is down

carp: VHID 1@em1: BACKUP -> MASTER (master down)

Is that off the pfsense that you didn't reboot?

First thing I would suggest vs rebooting.. Is actually look to why it can not talk to whatever.. What are the errors in the log when it can not talk.. In carp setup it should failover if there is an issue with it, etc.. So sounds like you have a problem with carp not working as well.

Gadmin

Yes, I'm using upsec. See attachment

Ipsec.png_thumb
![Ipsec rules.png](/public/imported_attachments/1/Ipsec rules.png)
![Ipsec rules.png_thumb](/public/imported_attachments/1/Ipsec rules.png_thumb)

Gadmin

It is off the pfsense that I rebooted.

And I think your right about the CARP. The second firewall only takes over if the first firewall turns off or reboots.

cmb

Guessing you're hitting the issue described here.
https://forum.pfsense.org/index.php?topic=110710.msg618388#msg618388

which we're working on tracking down. The workaround there should suffice in the mean time for the few who are routinely hitting that.

Gadmin

I see that 2.3.1 is released. Will this update solve the problem that we have to run on 1 cpu core to ensure internet connection?

cmb

@Gadmin:

I see that 2.3.1 is released. Will this update solve the problem

Yes, 2.3.1 and newer fix that issue.