Major issue with QUAGGA-OSPF and VLANs (pfsense 2.3.0)

heper

Thanks. Ive bumped the redmine ticket Yesterday.

Hopefully it'll get fixed soon

miguelgoncalves

Hi!

I am also seeing this behaviour… Asked about it here: https://forum.pfsense.org/index.php?topic=112698.0

Attached are configuration files. These were created manually because I had to include some commands to stop Quagga inserting routes to the OpenVPN addresses into the kernel. It worked before. A recent upgrade stopped the failover from working.

I really hope this is solved quickly.

Cheers,
Miguel

dc_ospfd.txt
dc_zebra.txt
hq_ospfd.txt
hq_zebra.txt

r.vanmoerkerk

No luck with support, they don't give any feedback or recognizes the issue. The test mentioned in the redmine is not a fair test. The bug has the effect that it advertises the whole network to itself so other bgp/ ospf instances in our netwerk are overwriten with this new data and locations are not reachable. It has nothing to do with wan failover in our case.

It could be that the extra kernel routes are the issue but if that is the case then try to fix this. All was doing well in previous configs and after upgrade this issue happend. After reversing quagga packages it is fixed so don't blame me for thinking that it is related to the quagga package.

How can we get some more action on this from the pfsense side? It is with issues like this that our management is not having faith in the solution, we have support but no response about this issue, not our package. It is part of the pfsense firewall suite product.

heper

i think it would be ideal if one of the coredevs reverts the pfsense package to quagga 0.99.x.x for now. (there wasn't anything wrong with it)

then the coredevs have more time to find a way to replicate the issue & report it upstream.

I believe this issue might affect a lot of quagga-users, but not all of them have noticed it…. in some cases you only notice it when an interface goes down.

echu2016

Hello All!!!
I´ve been with this annoying bug like three long long days!!
While I realized that wasn´t only me, i quickly solved by reverting the package to an older version as proposed previously in this thread (thanks!)

For me is quite easy to reproduce it.
Let´s start by assuming we have a running and configured instance on an pfSense box.
Our daemon now learns a brand new route, for instance 10.1.1.0/24.
Example output:

Quagga Zebra Routes:

Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, P - PIM, A - Babel,
> - selected route, * - FIB route

O>* 10.1.1.0/24 [110/12] via 192.168.123.13, em5, 00:00:31

We now have a next hop change (because of a link down situation).

That line would now be seen (in my case) like this:

O>* 10.1.1.0/24 [110/12] via 192.168.19.25, em5, 00:00:02

(sorry for the upercase)
UP TO HERE OK!!!!

BUT, let´s go back to the original route:

O>* 10.1.1.0/24 [110/12] via 192.168.123.13, em5, 00:00:31

IF, in this step for any reason zebra is reloaded or restarted from now on we will see like this:

O> 10.1.1.0/24 [110/12] via 192.168.123.13, em5, 00:00:31
K>* 10.1.1.0/24 [110/12] via 192.168.123.13, em5, 00:00:31

What happens in a failover scenario? Well… This:

O> 10.1.1.0/24 [110/12] via 192.168.19.25, em5, 00:01:20
K> 10.1.1.0/24 [110/12] via 192.168.123.13, em5, 00:00:05*

Red line shows the problem!!! Kernel route is wrong!!
As far as i read, there is a daemon option line "–keep-kernel" That says zebra to preserve previous learned routes before actually booting up.

If my explanation seems ok, then there is only one simple way to reproduce it:

1- Make OSPF learn a new route.
2- Go to services and restart both :Quagga OSPFd and Quagga Zebra daemons.
3- Try to alter the paths and see that the line beggining with K won´t change any more!!!

Hope I helped!

Thanks!!!

georgeman

Bump!!

Any updates on this? Unfortunately I don't have an appropiate lab to test what echu2016 posted above, and my production systems are currently running the previous version of the Quagga package as suggested.
But what he posted makes perfect sense, and should be pretty simple to reproduce and track.

jimp

After restarting services and yanking (virtual) cables I did manage to make it break, once.

If it is related to restarting zebra, this patch might help:

http://files.atx.pfsense.org/jimp/patches/skip_restart_for_routing_packages-2.3.1.patch

Ultimately someone that can reproduce this reliably needs to report this directly to quagga since it appears to be a problematic change introduced in their 1.0.x code base.

Trey

Hi,

this problem is a real show stopper. Has nobody a config, that we can supply to the quagga team in order to fix the problem? This problem really sucks, as it is only showing itself from time to time…

Dear pfsense team, what about a paid bugfix? What should it cost?!

regards

trey

jimp

We can't reliably reproduce it here, and it isn't our code to fix. It's something in Quagga 1.x on FreeBSD, so you'd be better off approaching the Quagga developers or maybe FreeBSD developers directly.

reqlez

Has anybody opened a ticket with quagga yet ? Because I can easily reproduce it here just have to pull the main link cable at any one of the two sides of the link and it breaks.

If nobody submitted I'll contact them when my projects settle down.

heper

i don't think anyone submitted anything.

echu2016

I don't have much experience in submitting bug reports and don't sincerely have any time for all the information/testing they require to accept them

What I can say right now is that yesterday I upgraded to PFSense 2.3.2 and Quagga package also was upgraded to version 1.+, everything described here before has happened again. Reproducing the issue is quite easy. Just leave Quagga learn a few routes, then just click save or manually restart the service and you will see the routes duplicated. One with the preceding O and the preferred one with the preceding K label.
Like This:

O> 10.33.150.128/25 [110/20] via 192.168.45.1, em2, 01:38:55
K>* 10.33.150.128/25 via 192.168.45.1, em2

If for some reason this dynamic route disappears or changes the next hop, the Kernel route would still be preferred and consequently the routing will be done incorrectly, like this:

O> 10.33.150.128/25 [110/20] via 192.168.129.1, em2, 00:05:13
K>* 10.33.150.128/25 via 192.168.45.1, em2

My solution again was rolling back to version 0.99 and locking the package to prevent further auto-updates.

pkg lock quagga

jmcentire

@reqlez:

Has anybody opened a ticket with quagga yet ? Because I can easily reproduce it here just have to pull the main link cable at any one of the two sides of the link and it breaks.

If nobody submitted I'll contact them when my projects settle down.

Were you able to contact them? I was slamming my head against the wall for hours this weekend trying to figure out routing problems all over my network when I had a connection go down.

rubic

can it be related? https://lists.quagga.net/pipermail/quagga-dev/2016-February/014777.html

reqlez

@jimp:

After restarting services and yanking (virtual) cables I did manage to make it break, once.

If it is related to restarting zebra, this patch might help:

http://files.atx.pfsense.org/jimp/patches/skip_restart_for_routing_packages-2.3.1.patch

Ultimately someone that can reproduce this reliably needs to report this directly to quagga since it appears to be a problematic change introduced in their 1.0.x code base.

I saw somewhere in quagga notes that something got fixed recently. About this no restart patch. will it work on latest update ? also …. why not just include an option to TURN OFF restart of network packages ? somewhere in advanced options ? That would really help those unstable lines bringing the network down even if it's lower priority link while quagga reboots.

Taras_

@jimp:

We can't reliably reproduce it here, and it isn't our code to fix. It's something in Quagga 1.x on FreeBSD, so you'd be better off approaching the Quagga developers or maybe FreeBSD developers directly.

I have 2 fresh pfSenses (SG-4860) with 2 ISPs/4 OpenVPNs and OSPF on top of it.
This issue reliably reproduced :) :( :( , i.e. kernel routes aren't removed/updated properly (see 10.0.9.0/24 route):

Codes: K - kernel route, C - connected, S - static, R - RIP,
       O - OSPF, I - IS-IS, B - BGP, P - PIM, A - Babel,
       > - selected route, * - FIB route

K>* 0.0.0.0/0 via 192.168.0.1, igb1
O   10.0.9.0/24 [110/60] via 10.255.255.101, igb5, 00:02:03
K>* 10.0.9.0/24 via 10.255.2.2, ovpns1
O   10.1.102.0/24 [110/50] via 10.255.2.2, ovpns1, 00:02:03
K>* 10.1.102.0/24 via 10.255.2.2, ovpns1
O   10.11.11.0/24 [110/10] is directly connected, lagg0, 00:02:16
C>* 10.11.11.0/24 is directly connected, lagg0
O   10.255.1.0/24 [110/70] via 10.255.2.2, ovpns1, 00:02:03
K>* 10.255.1.0/24 via 10.255.2.2, ovpns1
O   10.255.2.0/24 [110/40] is directly connected, ovpns1, 00:02:16
C>* 10.255.2.0/24 is directly connected, ovpns1
O   10.255.255.0/24 [110/50] is directly connected, igb5, 00:02:16
C>* 10.255.255.0/24 is directly connected, igb5
C>* 127.0.0.0/8 is directly connected, lo0
C>* 192.168.0.0/24 is directly connected, igb1

My primary question is if Quagga introduced some problems in recent updates may be we should return to version which don't have problems and push it through pfsense's packages?
I have 2 support incidents from pfsense team, may be I should spent one of them on this problem?

reqlez

@jimp:

After restarting services and yanking (virtual) cables I did manage to make it break, once.

If it is related to restarting zebra, this patch might help:

http://files.atx.pfsense.org/jimp/patches/skip_restart_for_routing_packages-2.3.1.patch

Ultimately someone that can reproduce this reliably needs to report this directly to quagga since it appears to be a problematic change introduced in their 1.0.x code base.

Okay I tried this patch in 2.3.2 and it wont work …

Also I submitted a request in quagga-users lost nobody got back to me yet.

reqlez

Okay got a reply ( from Martin Winters the quagga god himself ! ) https://lists.quagga.net/pipermail/quagga-users/2016-October/014474.html

I actually contacted the maintainer of freebsd port for quagga and he referred me to the list as he doesn't think this is port related.

If you guys want to pitch in, go ahead… Martin is asking to compile latest code from git ... and honestly I have never complied zebra before, i think the last thing i complied on freebsd was java lol

reqlez

Here is another comment Martin from Quagga made: "I don’t see why pfsense would restart Quagga - so I think this might
be a bug. But there might be other reasons for it which I’m unaware
of."

I actually have some logs that I will be submitting either tonight or tomorrow.

reqlez

OSPFD / ZEBRA Debug logs submitted to Martin. Now we wait and see. I have tried his "latest" development package and it does the same thing.