Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    CARP/HA IPSec on Backup Node - connection not found?

    Scheduled Pinned Locked Moved HA/CARP/VIPs
    17 Posts 2 Posters 1.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DerelictD
      Derelict LAYER 8 Netgate
      last edited by Derelict

      Then I would edit/save the con2000 VPN connection on the primary again. There must have been a syncing issue at one time.

      If that does not work I would delete it and recreate it on the primary.

      Or backup and restore just the IPSEC section on the primary.

      2.3.5 is EOL. As is the underlying FreeBSD 10.3. You'd do well to get to 2.4.4

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      1 Reply Last reply Reply Quote 0
      • S
        sepp_huber
        last edited by sepp_huber

        Hi,

        after backup and restore the IPSec config there where no sync errors...
        But after a rolling restart of both nodes the ipsec configuration is synced again.
        => solved
        I am wondering why a reboot helped... it is not a Windows system ;-)

        Thanks for your hint of eol 2.3.5... I have looked here:
        https://www.netgate.com/docs/pfsense/releases/index.html#current-upcoming-supported-releases
        It is still listed as supported in the documentation.

        DerelictD 2 Replies Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate @sepp_huber
          last edited by

          @sepp_huber said in CARP/HA IPSec on Backup Node - connection not found?:

          It is still listed as supported in the documentation.

          Not for long. Thanks. ;)

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate @sepp_huber
            last edited by

            @sepp_huber said in CARP/HA IPSec on Backup Node - connection not found?:

            I am wondering why a reboot helped... it is not a Windows system ;-)

            A restart completely rebuilds all configuration files from the config.xml file.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • S
              sepp_huber
              last edited by

              @derelict said in CARP/HA IPSec on Backup Node - connection not found?:

              A restart completely rebuilds all configuration files from the config.xml file.

              OK...
              After changing something on the primary it is still not synced to the secondary.
              Anyway, I can live with this workaround => reboot of the secondary after changing the ipsec configuration.

              I will update to 2.4.X in the next weeks.

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                I would continue to work the problem. That is certainly not normal.

                Is IPsec checked in the XMLRPC sync settings on the primary?

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • S
                  sepp_huber
                  last edited by

                  As already stated in my inital post here... yes everything in the sync settings is checked AND there are no sync errors in the logs. Is there a debugging/logging feature for the XMLRPC sync?

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    The system logs tell you what it is complaining about.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • S
                      sepp_huber
                      last edited by

                      No errors on master

                      Nov 12 10:52:22	php-fpm		/rc.filter_synchronize: Filter sync successfully completed with http://192.168.XXX.XXX:80.
Nov 12 10:52:21	php-fpm		/rc.filter_synchronize: XMLRPC sync successfully completed with http://192.168.XXX.XXX:80.
Nov 12 10:52:21	php-fpm		/rc.filter_synchronize: Beginning XMLRPC sync to http://192.168.XXX.XXX:80.

                      Filter reload sync output extract on master

                      ...
Pre-caching IPSec Port...
Creating filter rule IPSec Port ...
Creating filter rules IPSec Port ...
Setting up pass/block rules
Setting up pass/block rules IPSec Port
Creating rule IPSec Port
Pre-caching IPSec Port...
Creating filter rule IPSec Port ...
Creating filter rules IPSec Port ...
Setting up pass/block rules
Setting up pass/block rules IPSec Port
Creating rule IPSec Port
...
Signaling CARP reload signal...
Syncing CARP data to http://192.168.XXX.XXX
XMLRPC sync successfully completed with http://192.168.XXX.XXX:80

                      But on the backup I found:

                      Nov 12 10:57:06	php-fpm	39865	/xmlrpc.php: The command '/usr/sbin/pw groupadd -n 'admins' -g '2000' -M '0' 2>&1' returned exit code '65', the output was 'pw: group name `admins' already exists'
                      1 Reply Last reply Reply Quote 0
                      • S
                        sepp_huber
                        last edited by

                        Hi,

                        after upgrading to 2.4.4, the synchronization still does not work.
                        The ipsec file on the backup node is outdated.
                        The message "/xmlrpc.php: The command '/usr/sbin/pw groupadd -n 'admins'..." does not appear anymore on the backup node.

                        1 Reply Last reply Reply Quote 0
                        • DerelictD
                          Derelict LAYER 8 Netgate
                          last edited by

                          I have no idea what the issue is there. Never appeared on any system I have been involved with before. XMLRPC generally works or it doesn't. It isn't selective as to what configs it syncs or what it doesn't.

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • S
                            sepp_huber
                            last edited by

                            I think the XMLRPCSync is working, there are no errors.
                            All changes are visible in the ipsec user interface of the second node and if I make a "diff" of the configuration-backup XML of both nodes... all ipsec changes are included in the configuration of the second node.
                            There must be an additional step after the XMLRPCSync which transfers the changes to "/var/etc/ipsec/ipsec.conf" and that fails or is not executed...
                            Because after a reboot the file is "in-sync" with the configuration.

                            Is it possible to change the debuglevel somewhere or add log output to the php source code?

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.