Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    CARP/HA IPSec on Backup Node - connection not found?

    HA/CARP/VIPs
    2
    17
    990
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      sepp_huber
      last edited by sepp_huber

      Hi.

      thanks for your hint - I have checked the files on both nodes:
      They differ totally! "conn2000" is missing.

      Master:

      ls -l
total 16
-rw-r--r--   1 root  wheel  1299 Nov  6 14:18 ipsec.conf

      Backup:

      ls -l
total 16
-rw-r--r--   1 root  wheel  732 Oct 16 13:35 ipsec.conf

      If I hit the "Force config sync" on the primary or if anything in the configuration of the primary is changed, the file is not synced or updated to the second node. It just changes on the primary.
      There are no sync errors:

      XMLRPC sync successfully completed with XXXX

      With UI I mean when I look into the User Interface of the IPSec configuration (VPN->IPSec), the configurations here are identical on both nodes! ... but not in the real IPSec config files (/var/etc/ipsec/ipsec.conf). This means the pfsense XML configuration of the second is not in sync with the ipsec config file.
      Btw, we still use 2.3.5-RELEASE-p2.

      Usually we use OpenVPN and we bind all our VPNs on the CARP-VIP (Server and Clients). They are only up on the primary and are down on the backup. They switch with the CARP-VIP... if the VIP is on the secondary all the connections come up automatically.
      Does this not work with IPSec connections?

      Thx for your help!

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by Derelict

        Then I would edit/save the con2000 VPN connection on the primary again. There must have been a syncing issue at one time.

        If that does not work I would delete it and recreate it on the primary.

        Or backup and restore just the IPSEC section on the primary.

        2.3.5 is EOL. As is the underlying FreeBSD 10.3. You'd do well to get to 2.4.4

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • S
          sepp_huber
          last edited by sepp_huber

          Hi,

          after backup and restore the IPSec config there where no sync errors...
          But after a rolling restart of both nodes the ipsec configuration is synced again.
          => solved
          I am wondering why a reboot helped... it is not a Windows system ;-)

          Thanks for your hint of eol 2.3.5... I have looked here:
          https://www.netgate.com/docs/pfsense/releases/index.html#current-upcoming-supported-releases
          It is still listed as supported in the documentation.

          DerelictD 2 Replies Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate @sepp_huber
            last edited by

            @sepp_huber said in CARP/HA IPSec on Backup Node - connection not found?:

            It is still listed as supported in the documentation.

            Not for long. Thanks. ;)

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate @sepp_huber
              last edited by

              @sepp_huber said in CARP/HA IPSec on Backup Node - connection not found?:

              I am wondering why a reboot helped... it is not a Windows system ;-)

              A restart completely rebuilds all configuration files from the config.xml file.

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • S
                sepp_huber
                last edited by

                @derelict said in CARP/HA IPSec on Backup Node - connection not found?:

                A restart completely rebuilds all configuration files from the config.xml file.

                OK...
                After changing something on the primary it is still not synced to the secondary.
                Anyway, I can live with this workaround => reboot of the secondary after changing the ipsec configuration.

                I will update to 2.4.X in the next weeks.

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  I would continue to work the problem. That is certainly not normal.

                  Is IPsec checked in the XMLRPC sync settings on the primary?

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • S
                    sepp_huber
                    last edited by

                    As already stated in my inital post here... yes everything in the sync settings is checked AND there are no sync errors in the logs. Is there a debugging/logging feature for the XMLRPC sync?

                    1 Reply Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate
                      last edited by

                      The system logs tell you what it is complaining about.

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • S
                        sepp_huber
                        last edited by

                        No errors on master

                        Nov 12 10:52:22	php-fpm		/rc.filter_synchronize: Filter sync successfully completed with http://192.168.XXX.XXX:80.
Nov 12 10:52:21	php-fpm		/rc.filter_synchronize: XMLRPC sync successfully completed with http://192.168.XXX.XXX:80.
Nov 12 10:52:21	php-fpm		/rc.filter_synchronize: Beginning XMLRPC sync to http://192.168.XXX.XXX:80.

                        Filter reload sync output extract on master

                        ...
Pre-caching IPSec Port...
Creating filter rule IPSec Port ...
Creating filter rules IPSec Port ...
Setting up pass/block rules
Setting up pass/block rules IPSec Port
Creating rule IPSec Port
Pre-caching IPSec Port...
Creating filter rule IPSec Port ...
Creating filter rules IPSec Port ...
Setting up pass/block rules
Setting up pass/block rules IPSec Port
Creating rule IPSec Port
...
Signaling CARP reload signal...
Syncing CARP data to http://192.168.XXX.XXX
XMLRPC sync successfully completed with http://192.168.XXX.XXX:80

                        But on the backup I found:

                        Nov 12 10:57:06	php-fpm	39865	/xmlrpc.php: The command '/usr/sbin/pw groupadd -n 'admins' -g '2000' -M '0' 2>&1' returned exit code '65', the output was 'pw: group name `admins' already exists'
                        1 Reply Last reply Reply Quote 0
                        • S
                          sepp_huber
                          last edited by

                          Hi,

                          after upgrading to 2.4.4, the synchronization still does not work.
                          The ipsec file on the backup node is outdated.
                          The message "/xmlrpc.php: The command '/usr/sbin/pw groupadd -n 'admins'..." does not appear anymore on the backup node.

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            I have no idea what the issue is there. Never appeared on any system I have been involved with before. XMLRPC generally works or it doesn't. It isn't selective as to what configs it syncs or what it doesn't.

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • S
                              sepp_huber
                              last edited by

                              I think the XMLRPCSync is working, there are no errors.
                              All changes are visible in the ipsec user interface of the second node and if I make a "diff" of the configuration-backup XML of both nodes... all ipsec changes are included in the configuration of the second node.
                              There must be an additional step after the XMLRPCSync which transfers the changes to "/var/etc/ipsec/ipsec.conf" and that fails or is not executed...
                              Because after a reboot the file is "in-sync" with the configuration.

                              Is it possible to change the debuglevel somewhere or add log output to the php source code?

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.