Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Gateways always offline - 2.3.2-RELEASE-p1 (amd64)

    Scheduled Pinned Locked Moved General pfSense Questions
    20 Posts 5 Posters 3.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DerelictD Offline
      Derelict LAYER 8 Netgate
      last edited by

      That is showing packets leaving and not being returned.

      Not sure what else to tell you there. Check upstream.

      There should be a reply for every request. If there is not that is the definition of ICMP packet loss.

      05:09:48.077929 IP 172.25.228.5 > 8.8.8.8: ICMP echo request, id 30741, seq 63, length 8
      05:09:48.115574 IP 8.8.8.8 > 172.25.228.5: ICMP echo reply, id 30741, seq 63, length 8
      05:09:48.579556 IP 172.25.228.5 > 8.8.8.8: ICMP echo request, id 30741, seq 64, length 8
      05:09:48.617289 IP 8.8.8.8 > 172.25.228.5: ICMP echo reply, id 30741, seq 64, length 8
      05:09:49.080939 IP 172.25.228.5 > 8.8.8.8: ICMP echo request, id 30741, seq 65, length 8
      05:09:49.118607 IP 8.8.8.8 > 172.25.228.5: ICMP echo reply, id 30741, seq 65, length 8
      05:09:49.582548 IP 172.25.228.5 > 8.8.8.8: ICMP echo request, id 30741, seq 66, length 8
      05:09:49.619924 IP 8.8.8.8 > 172.25.228.5: ICMP echo reply, id 30741, seq 66, length 8
      05:09:50.084023 IP 172.25.228.5 > 8.8.8.8: ICMP echo request, id 30741, seq 67, length 8
      05:09:50.121874 IP 8.8.8.8 > 172.25.228.5: ICMP echo reply, id 30741, seq 67, length 8
      05:09:50.585591 IP 172.25.228.5 > 8.8.8.8: ICMP echo request, id 30741, seq 68, length 8
      05:09:50.622230 IP 8.8.8.8 > 172.25.228.5: ICMP echo reply, id 30741, seq 68, length 8
      05:09:51.088961 IP 172.25.228.5 > 8.8.8.8: ICMP echo request, id 30741, seq 69, length 8
      05:09:51.126111 IP 8.8.8.8 > 172.25.228.5: ICMP echo reply, id 30741, seq 69, length 8
      05:09:51.590576 IP 172.25.228.5 > 8.8.8.8: ICMP echo request, id 30741, seq 70, length 8
      05:09:51.628037 IP 8.8.8.8 > 172.25.228.5: ICMP echo reply, id 30741, seq 70, length 8
      05:09:52.091982 IP 172.25.228.5 > 8.8.8.8: ICMP echo request, id 30741, seq 71, length 8
      05:09:52.127754 IP 8.8.8.8 > 172.25.228.5: ICMP echo reply, id 30741, seq 71, length 8
      05:09:52.593572 IP 172.25.228.5 > 8.8.8.8: ICMP echo request, id 30741, seq 72, length 8
      05:09:52.630214 IP 8.8.8.8 > 172.25.228.5: ICMP echo reply, id 30741, seq 72, length 8

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      1 Reply Last reply Reply Quote 0
      • DerelictD Offline
        Derelict LAYER 8 Netgate
        last edited by

        76.187.232.93 > 8.8.8.8: ICMP echo request, id 12666, seq 29675, length 8
        23:08:09.578604 00:0c:29:af:40:bd > 00:01:5c:77:7a:46, ethertype IPv4 (0x0800), length 42: (tos 0x0, ttl 64, id 14554, offset 0, flags [none], proto ICMP (1), length 28)
        76.187.232.93 > 8.8.8.8: ICMP echo request, id 12666, seq 29676, length 8
        23:08:09.593479 00:01:5c:77:7a:46 > 00:0c:29:af:40:bd, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 56, id 35629, offset 0, flags [none], proto ICMP (1), length 28)

        You have something hosed in your environment. You have two sets of pings being seen on that interface with the same source IP address and reciprocal MAC addresses. No idea what you did there.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • F Offline
          Fmslick
          last edited by

          @Derelict:

          That is showing packets leaving and not being returned.

          Not sure what else to tell you there. Check upstream.

          There should be a reply for every request. If there is not that is the definition of ICMP packet loss.

          05:09:48.077929 IP 172.25.228.5 > 8.8.8.8: ICMP echo request, id 30741, seq 63, length 8

          How do I go about checking the upstream? Even though I think it will prove you are correct. due to when I run a speedtest my upstream times out.

          –--

          @Derelict:

          76.187.232.93 > 8.8.8.8: ICMP echo request, id 12666, seq 29675, length 8
          23:08:09.578604 00:0c:29:af:40:bd > 00:01:5c:77:7a:46, ethertype IPv4 (0x0800), length 42: (tos 0x0, ttl 64, id 14554, offset 0, flags [none], proto ICMP (1), length 28)
          76.187.232.93 > 8.8.8.8: ICMP echo request, id 12666, seq 29676, length 8
          23:08:09.593479 00:01:5c:77:7a:46 > 00:0c:29:af:40:bd, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 56, id 35629, offset 0, flags [none], proto ICMP (1), length 28)

          You have something hosed in your environment. You have two sets of pings being seen on that interface with the same source IP address and reciprocal MAC addresses. No idea what you did there.

          Huh? I didn't do anything, no odd settings just everything out of the box.

          I added a pic of my esxi network configuration up there^ (i'll add it to this post) and yes I have 2 Sense box's as VM's (One old) (One new) but only one is booted up at this time and that is the new one (which is the one I'm having an issue with), in less the vSwitch is an issue?

          –EDIT
          pfSense MAC is 00:0c:29:af:40:bd
          I am looking for this MAC 00:01:5c:77:7a:46 I don't know what it is.

          Screenshot_155.png
          Screenshot_143.png
          Screenshot_143.png_thumb
          Screenshot_154.png
          Screenshot_154.png_thumb

          We all start same where

          1 Reply Last reply Reply Quote 0
          • DerelictD Offline
            Derelict LAYER 8 Netgate
            last edited by

            Not sure. Sorry. Much more familiar with XenServer. Having two MAC addresses out there for the same IP address will undoubtedly screw things up though. Are there a bunch of IP conflicts being logged in the system log? Maybe look around in ESXi to see what those two MAC addresses are.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • F Offline
              Fmslick
              last edited by

              @Derelict:

              Not sure. Sorry. Much more familiar with XenServer. Having two MAC addresses out there for the same IP address will undoubtedly screw things up though.

              All good man, thanks for the help anyhow. Yeah I was using Xenserver but due to can't live migrate unless you have the exact same Hardware for every hypervisor turned me off and away from Xen. Was running proxmox but started to run in to stupid issues and stuff was braking all the time.

              Are there a bunch of IP conflicts being logged in the system log?

              Nope not that I can tell.

              Maybe look around in ESXi to see what those two MAC addresses are.

              I know the 00:0c:29:af:40:bd is pfSense but for the life of me I can not find 00:01:5c:77:7a:46

              –
              I think i'll just take down my network and install pfSense on real hardware and see if I still have the same issue, I mean the ESXi box was built for the sole purpose of running pfSense but I decided to utilize more of its power sometime back. I will post back in a few days and let you know my findings.

              THANKS  ;D

              We all start same where

              1 Reply Last reply Reply Quote 0
              • dennypageD Offline
                dennypage
                last edited by

                @Fmslick:

                I know the 00:0c:29:af:40:bd is pfSense but for the life of me I can not find 00:01:5c:77:7a:46

                Arris (Cadant) modem?

                1 Reply Last reply Reply Quote 0
                • F Offline
                  Fmslick
                  last edited by

                  @dennypage:

                  @Fmslick:

                  I know the 00:0c:29:af:40:bd is pfSense but for the life of me I can not find 00:01:5c:77:7a:46

                  Arris (Cadant) modem?

                  No it's not the Arris modem, I was thinking the samething an it was one of the first things I looked up. It ends with aa:47.

                  I have a feeling the the 7a:46 is coming from something in esxi like vswitch or something.

                  We all start same where

                  1 Reply Last reply Reply Quote 0
                  • dennypageD Offline
                    dennypage
                    last edited by

                    The OUI is for an Arris modem. It would be rather odd that this MAC address would randomly appear in your installation and not be associated with the modem. VMware has their own OUI (which matches your other MAC address). Modems have multiple MAC addresses. I would suggest logging into the thing and try cataloging them.

                    1 Reply Last reply Reply Quote 0
                    • J Offline
                      javcasta
                      last edited by

                      Hi.

                      Cadant INC. 00:01:5C http://macvendors.co/v/9690/CADANT-INC.

                      Regards.

                      Javier Castañón
                      Técnico de comunicaciones, soporte y sistemas.

                      Mi web: https://javcasta.com/

                      Soporte scripting/pfSense https://javcasta.com/soporte/

                      1 Reply Last reply Reply Quote 0
                      • F Offline
                        Fmslick
                        last edited by

                        Sorry it was late last night.

                        @dennypage:

                        The OUI is for an Arris modem. It would be rather odd that this MAC address would randomly appear in your installation and not be associated with the modem. VMware has their own OUI (which matches your other MAC address). Modems have multiple MAC addresses. I would suggest logging into the thing and try cataloging them.

                        Yep you are right about the OUI's but wrong, Cable Modem MAC Address = D4:0A:A9:52:AA:47 (pic below) and it is randomly appear in my installation. Maybe the ISP got something wrong? lol I am at a loss now.

                        @javcasta:

                        Hi.

                        Cadant INC. 00:01:5C http://macvendors.co/v/9690/CADANT-INC.

                        Regards.

                        Thanks for the link :) but still not it. Cable Modem MAC Address = D4:0A:A9:52:AA:47

                        Screenshot_157.png_thumb
                        Screenshot_157.png

                        We all start same where

                        1 Reply Last reply Reply Quote 0
                        • DerelictD Offline
                          Derelict LAYER 8 Netgate
                          last edited by

                          It's in your packet capture. It's coming from somewhere. Check the MAC address tables in your switches, etc. Wireshark out on a mirror port on the physical network. Something.

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • F Offline
                            Fmslick
                            last edited by

                            @Derelict:

                            It's in your packet capture. It's coming from somewhere. Check the MAC address tables in your switches, etc. Wireshark out on a mirror port on the physical network. Something.

                            ;D  "Something" ok will do.

                            We all start same where

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.