Watchguard XTM 5 Series

blaxx

Hi !

I don't know if this is a pfsense or XTM5 problem but I'll give it a try.

I have two XTM5 (510 and 525) with original BIOS and hardware except for hard drives that I have installed latest pfsense 2.3.4-p1 on. I have never used pfsense before so I installed it on these firewalls to see if it works. No changes are made on the config after first boot.

The problem is that after a couple of days both of the firewalls stops routing all traffic. Cant reach them from webgui and cant connect to internet at all anymore.
The only solution I've found is to pull the plug. After that it works for a couple of days again.

I read an old thread regarding a bug when using multicore cpu so I tried that fix by disabling all but one core but that didn't help.

Anyone have an idea regarding what might be the problem?

Kind regards

Stellan

chpalmer

Im going towards another problem. Such as a bad switch or interface card on your computer or..

There is no problem running multiple cores. Im on 4 here on my XTM and many others with other boxes more than that.

Do you have a console cable so you can monitor with a program like Putty? Id be curious about what dmesg shows as this happens..

blaxx

@chpalmer:

Im going towards another problem. Such as a bad switch or interface card on your computer or..

There is no problem running multiple cores. Im on 4 here on my XTM and many others with other boxes more than that.

Do you have a console cable so you can monitor with a program like Putty? Id be curious about what dmesg shows as this happens..

Thanks for your reply.

The "issue" is that both of the firewalls have the same problem and they ran fine with Watchguard OS on them. I have a hard time believing that there should be faulty hardware on both of them but I can't be certain.

I have a console cable I can plug in and connect with putty but I'm very new to pfsense and linux in general so I don't know what you want me to test.

Do you have a command I should write when the error occurs?

A Former User

This post is deleted!

chpalmer

@blaxx:

The "issue" is that both of the firewalls have the same problem and they ran fine with Watchguard OS on them. I have a hard time believing that there should be faulty hardware on both of them but I can't be certain.

I have a console cable I can plug in and connect with putty but I'm very new to pfsense and linux in general so I don't know what you want me to test.

Do you have a command I should write when the error occurs?

choose option 8 and type dmesg after a failure.

When you say you can't reach the gui- are you using a host name or an IP address?

I don't think your boxes are bad.. I think you have a switch or other device on you network going south. But some troubleshooting is in order.

blaxx

@chpalmer:

@blaxx:

The "issue" is that both of the firewalls have the same problem and they ran fine with Watchguard OS on them. I have a hard time believing that there should be faulty hardware on both of them but I can't be certain.

I have a console cable I can plug in and connect with putty but I'm very new to pfsense and linux in general so I don't know what you want me to test.

Do you have a command I should write when the error occurs?

choose option 8 and type dmesg after a failure.

When you say you can't reach the gui- are you using a host name or an IP address?

I don't think your boxes are bad.. I think you have a switch or other device on you network going south. But some troubleshooting is in order.

Connecting through IP to the gui.

I dont have any switches attached to the firewalls. One of them is just powered up with nothing connected to it and the other one has a DSL-line in WAN and one PC in LAN0.

I will try dmesg and reply here next time it happens.

stephenw10

@blaxx
Yeah, if the console responds at all then it's probably not a hardware problem. Just hitting return there should re-draw the console menu. Something should be logged.

@747Builder
Do you see Speedstep working correctly on any of those?

I have a feeling it could just be the CPU (E4500) I have here but it's the only one I've tested it with so….

Steve

A Former User

This post is deleted!

stephenw10

On the dashboard it will report the Current vs Max frequency, that's probably easiest. See screenshot.

You can also see the current and available levels in the sysctls:

[2.4.0-BETA][root@8860.stevew.lan]/root: sysctl dev.cpu.0
dev.cpu.0.temperature: 32.0C
dev.cpu.0.coretemp.throttle_log: 0
dev.cpu.0.coretemp.tjmax: 98.0C
dev.cpu.0.coretemp.resolution: 1
dev.cpu.0.coretemp.delta: 66
dev.cpu.0.cx_method: C1/hlt
dev.cpu.0.cx_usage_counters: 2723221
dev.cpu.0.cx_usage: 100.00% last 47776us
dev.cpu.0.cx_lowest: C1
dev.cpu.0.cx_supported: C1/1/0
dev.cpu.0.freq_levels: 2400/8 2200/0 2000/0 1800/0 1600/0 1400/0 1200/0
dev.cpu.0.freq: 1200
dev.cpu.0.%parent: acpi0
dev.cpu.0.%pnpinfo: _HID=none _UID=0
dev.cpu.0.%location: handle=\_PR_.CPU0
dev.cpu.0.%driver: cpu
dev.cpu.0.%desc: ACPI CPU

And you can see the est driver loader against the cpu cores:

[2.4.0-BETA][root@8860.stevew.lan]/root: cat /var/log/dmesg.boot | grep est
est0: <enhanced speedstep="" frequency="" control="">on cpu0
est1: <enhanced speedstep="" frequency="" control="">on cpu1
est2: <enhanced speedstep="" frequency="" control="">on cpu2
est3: <enhanced speedstep="" frequency="" control="">on cpu3</enhanced></enhanced></enhanced></enhanced>

Steve

Selection_277.png_thumb

SONiQz

Hi All,

I have an XTM505 and an XTM330 which we've pulled from active service…. So now I have some new desk ornaments!

Anyway, I've pulled the 505 apart and had aimed to see what pfSense can do for me. So I've thrown a new Kingston 4GB CF in with a 2GB image of "pfSense 2.3.4 NanoBSD" as I was hoping to run from the CF, however I seem to run into a somewhat inconsistent issue. If I reboot the device the CF seems to sometimes crap itself and I get dumped into a Single User Mode prompt (if it gets past POST) and errors when I try to remount the CF as R/W so then I need to reflash..... Hardly ideal.

I do see errors like: "DMA limited to UDMA33, controller found non-ATA66 cable" when it does successfully boot, but other than that there's nothing out of the ordinary. I have dropped the original 1GB CF back in and that seems fine so I don't think there is a board issue. And the 4GB CF is new and seems to write and verify so I am a bit baffled as I wasn't really planning on dropping a HDD in it as I don't have a cradle spare.

Has anyone else had similar issues or suggestions as to what may be causing the problem I'm all ears!

Thanks in advance

stephenw10

I didn't think it was required on that board but you may need to disable UDMA for CF card if yours is particularly fussy:
https://doc.pfsense.org/index.php/Boot_Troubleshooting#pfSense_2.2_and_later

Steve

DeLorean

@SONiQz:

Hi All,

I have an XTM505 and an XTM330 which we've pulled from active service…. So now I have some new desk ornaments!

Anyway, I've pulled the 505 apart and had aimed to see what pfSense can do for me. So I've thrown a new Kingston 4GB CF in with a 2GB image of "pfSense 2.3.4 NanoBSD" as I was hoping to run from the CF, however I seem to run into a somewhat inconsistent issue. If I reboot the device the CF seems to sometimes crap itself and I get dumped into a Single User Mode prompt (if it gets past POST) and errors when I try to remount the CF as R/W so then I need to reflash..... Hardly ideal.

I do see errors like: "DMA limited to UDMA33, controller found non-ATA66 cable" when it does successfully boot, but other than that there's nothing out of the ordinary. I have dropped the original 1GB CF back in and that seems fine so I don't think there is a board issue. And the 4GB CF is new and seems to write and verify so I am a bit baffled as I wasn't really planning on dropping a HDD in it as I don't have a cradle spare.

Has anyone else had similar issues or suggestions as to what may be causing the problem I'm all ears!

Thanks in advance

If you use the Kingston 4GB standard type, that's without doubt your cause of problems.
These cards are so slow that they cause all kinds of ATA errors.
Disabling UDMA will not help for this issue.
I have seen this behaviour the first time on a x750e , and there was UDMA disabled and still ATA errors.
Switching to another brand or use the 16Gb High Speed version of Kingston and your problem is vanished :-)

Grtz
DeLorean

A Former User

This post is deleted!

Billyboy

Hi all,
I have two XTM5 (505 and 515) with the BIOS:

Vendor: American Megatrends Inc.
Version: 080015
Release Date: 02/03/2010

and upgraded hardware on both:

CPU: Intel E5800 @ 3.2 Ghz
RAM: 2 GB
SSD: 60 GB

running on the latest pfsense 2.3.4-p1.

I have configured the boxes for HA failover through CARP and with MultiWAN.

While I was testing the failover, I recognized problem:

When I pull a cable out of any of the em ports, Pfsense needs more than 5 Minutes to change the interface to down (both in the GUI DASHBOARD as well as on the Interfaces status page). However the port LEDs are switched off imediatelly.

I found the following in the syslog:

Aug 24 16:24:35 php-fpm[55068]: /rc.dyndns.update: MONITOR: WAN5_1GW is down, omitting from routing group WAN_GWG_654_LB 199.7.83.42|192.168.245.101|WAN5_1GW|17.248ms|4.241ms|24%|down
Aug 24 16:31:24 kernel: em4: Watchdog timeout Queue[0]– resetting
Aug 24 16:31:24 kernel: Interface is RUNNING and ACTIVE
Aug 24 16:31:24 kernel: em4: TX Queue 0 ------
Aug 24 16:31:24 kernel: em4: hw tdh = 61, hw tdt = 21
Aug 24 16:31:24 kernel: em4: Tx Queue Status = -2147483648
Aug 24 16:31:24 kernel: em4: TX descriptors avail = 40
Aug 24 16:31:24 kernel: em4: Tx Descriptors avail failure = 39
Aug 24 16:31:24 kernel: em4: RX Queue 0 ------
Aug 24 16:31:24 kernel: em4: hw rdh = 518, hw rdt = 517
Aug 24 16:31:24 kernel: em4: RX discarded packets = 0
Aug 24 16:31:24 kernel: em4: RX Next to Check = 518
Aug 24 16:31:24 kernel: em4: RX Next to Refresh = 517
Aug 24 16:31:24 kernel: carp: demoted by 240 to 240 (interface down)
Aug 24 16:31:24 kernel: em4: link state changed to DOWN

On the first entry (16:24:35), the Gateway goes down because of the disconnected cable.
More than 6 Minutes later, at 16:31:24 the system changed the link state to down.

On the fxp0 port, everything works fine.

Anyone have an idea regarding what might be the problem?

Kind regards

stephenw10

Hmm, curious, I don't think I've ever seen that.

Do you see that happen with all the NICs or just em4? Both boxes behave like that?

Steve

Billyboy

This happens to both boxes on all em Ports. :(

stephenw10

Hmm, and you're actually pulling the cable from the port on the xtm5?

What does ifconfig show for that port during that time?

Steve

Smoothrunnings

On the WatchGuard XTM 5 motherboard do any of the pin-outs and or sockets support a VGA connector?

I have been looking on Google but nothing I see points to anyone investigating if a VGA connector can be connected to the motherboard or not.

Thanks,

stephenw10

It does have a VGA header, J9, on the rear left of the board. It's a 2mm pitch connector though like most of these boxes not the more common 0.1".

I've never tried it myself.

Steve

cyablo

Edit: See post below…