• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Snort won't start after upgrade to 21.02 on SG-3100

IDS/IPS
12
43
9.6k
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • S
    s0m3f00l
    last edited by Jun 15, 2021, 11:44 PM

    All I can't pinpoint exactly whats wrong but the packages I am having trouble with on the SG-3100 in 21.05 with the patch applied are

    • suricata
    • pfblockerng-dev

    It seems they both stop working without much of an error message other than stopped. Unfortunately my time for troubleshooting has come to an end. And I need to return this connection to production w/o things breaking every 2 or 3 days.

    I would really like some insight into what the DEVs are using to test AND what is the recommended HW for small sites. 5100 seems like overkill but we need something that is going to be supported and not dropped after 3 or so years. Juniper/cisco make great firewall only routers, I was led to believe that the SG-3100 could do more than that. But it appears thats going away.

    So in small sites what is the recommended HW that devs are testing for?

    1 Reply Last reply Reply Quote 0
    • H
      Hichem @SteveITS
      last edited by Jun 16, 2021, 6:40 AM

      @steveits said in Snort won't start after upgrade to 21.02 on SG-3100:

      @styxl said in Snort won't start after upgrade to 21.02 on SG-3100:

      is there a fix for this in the hopper

      I'm not a dev but if the issue is with PHP then it could go all the way back to Zend to find and fix it. And then it would presumably be in a p2 patch. I'm not optimistic it will be "soon."

      @rek0n I haven't done this myself but this seems like the right path:

      • get a copy of the 2.4.5 installer from Netgate (go.netgate.com)
      • install 2.4.5
      • set to Previous Stable Version in System/Update (to install 2.4.5 packages not 2.5)
      • install desired packages
      • restore configuration
      • double check Previous Stable Version is still set

      We just bought 2 x SG-3100 with 21.02 how we get the stable version ?
      Because snort and suricata dont work and we can't use 2 x SG-3100 without IDS/IPS in our datacenter.

      S S 2 Replies Last reply Jun 16, 2021, 10:11 AM Reply Quote 0
      • S
        s0m3f00l @Hichem
        last edited by s0m3f00l Jun 16, 2021, 10:12 AM Jun 16, 2021, 10:11 AM

        @hichem 100% honesty. If you just bought them I would return them for the sg-5100. Otherwise you will need to downgrade to 2.4.5p1 by putting a ticket to support. But netgate doesn't seem to be interested in fixing this issue... Currently we are sitting at around 5 months with one patch.

        1 Reply Last reply Reply Quote 0
        • S
          SteveITS Galactic Empire @Hichem
          last edited by Jun 16, 2021, 2:19 PM

          @hichem said in Snort won't start after upgrade to 21.02 on SG-3100:

          how we get the stable version

          Open a ticket per the message you quoted. There is no support contract needed to get the firmware.

          @s0m3f00l said in Snort won't start after upgrade to 21.02 on SG-3100:

          around 5 months with one patch

          For the PHP issue you mean? They've had 21.02-p1 and 21.02.2, and 21.5. I am of the opinion it's lucky Netgate found a way to work around the PHP bug without PHP/Zend fixing it in code.

          @s0m3f00l said in Snort won't start after upgrade to 21.02 on SG-3100:

          what is the recommended HW for small sites

          What bandwidth do you have? If it's low enough the 2100 should be OK otherwise there is a jump to the 5100.

          Another option would be any x64 hardware with multiple NICs and the pfSense CE version.

          Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
          When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
          Upvote 👍 helpful posts!

          S H 2 Replies Last reply Jun 16, 2021, 5:56 PM Reply Quote 0
          • S
            s0m3f00l @SteveITS
            last edited by Jun 16, 2021, 5:56 PM

            @steveits

            For the PHP issue you mean? They've had 21.02-p1 and 21.02.2, and 21.5. I am of the opinion it's lucky Netgate found a way to work around the PHP bug without PHP/Zend fixing it in code.

            The first patch for SG-3100 was in 21.05 I am subscribed to the bugs on redmine and I saw it rollout. But honestly I do understand that the underlying issue maybe PHP or some obscure code in the compiler. I just don't see it as my issue. The problem in truth is that I and many others need SNORT/Suricata. The PHP breaks that. I appreciate that you seem to have repaired PHP? But Suricata and Snort (after testing) still appear to be broken for about 4 months now. Even more distressing is, after testing I cannot easily rollback as the old software packages appear to have moved on at this point and the newer ones have issue on the old software.

            What bandwidth do you have? If it's low enough the 2100 should be OK otherwise there is a jump to the 5100.

            Bursting to 1 Gig overnight as I said in the other thread. But again I think there is miscommunication here @steveits
            The real question is what HW is being developed on so I can avoid any issue like this in the future. Is it the ARM64? AMD64? ARM32? SG-5100? Third party Hardware? If you tell me what is being developed for I would be more than happy to buy it. The SG-3100 I bought in 2018 is just a firewall now. I could have gone in the USG direction if I had known that we were losing support. And deprecating the old packages so they cannot be installed. I appreciate that you are trying to help, but I do not want to have to change platforms this quickly in the future.

            S 1 Reply Last reply Jun 16, 2021, 6:18 PM Reply Quote 0
            • S
              SteveITS Galactic Empire @s0m3f00l
              last edited by Jun 16, 2021, 6:18 PM

              @s0m3f00l Oh I understand, we have primarily sold the 3100 to clients, and have one in use ourselves. We haven't tried to upgrade any of those to 21.x yet. We've sold a few 2100s since their introduction last fall, and it would be great if there was a 4100 but that doesn't exist.

              These issues are all specific to the 3100 which is a 32 bit ARM CPU. I think the discontinued SG-1000 was also 32 bit (?) but the rest are either 64 bit ARM or Intel.

              The issue I think (and I'm not a dev just a customer/partner) is the 32 bit ARM CPU is not in wide usage so is basically an edge case for the people developing FreeBSD and these other projects. As bmeeks pointed out there are compiler issues which is coming from the FreeBSD developers, and if they don't dedicate time to fixing it then it's not really something Netgate can fix. The PHP bug is new and apparently tied to the JIT (just in time) precompiler for PCRE (regular expression engine), and since it's coming from Zend/PHP they need to allocate resources to test on it. Likewise the newer Suricata changed languages to Rust which no one's ported to 32 bit ARM.

              The 64 bit ARM (specific to Netgate hardware) and 64 bit Intel/AMD (Netgate or third party) are all fine. If you want to look at third party hardware, FreeBSD 12.2 will have a compatibility list somewhere, but offhand I'd say Intel NICs are widely recommended here and the rest is probably not of any significant concern.

              Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
              When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
              Upvote 👍 helpful posts!

              1 Reply Last reply Reply Quote 0
              • H
                Hichem @SteveITS
                last edited by Jun 17, 2021, 7:30 AM

                @steveits said in Snort won't start after upgrade to 21.02 on SG-3100:

                @hichem said in Snort won't start after upgrade to 21.02 on SG-3100:

                how we get the stable version

                Open a ticket per the message you quoted. There is no support contract needed to get the firmware.

                I find only this url : https://netgate.myfreshworks.com/login?redirect_uri=https%3A%2F%2Fnetgate.myfreshworks.com%2F

                But can't create account for opening ticket.

                S 1 Reply Last reply Jun 17, 2021, 3:40 PM Reply Quote 0
                • S
                  SteveITS Galactic Empire @Hichem
                  last edited by Jun 17, 2021, 3:40 PM

                  @hichem I see what you mean. Try https://go.netgate.com/support/home?login_error=true.

                  Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                  When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                  Upvote 👍 helpful posts!

                  H 1 Reply Last reply Jun 17, 2021, 3:42 PM Reply Quote 1
                  • H
                    Hichem @SteveITS
                    last edited by Jun 17, 2021, 3:42 PM

                    @steveits said in Snort won't start after upgrade to 21.02 on SG-3100:

                    @hichem I see what you mean. Try https://go.netgate.com/support/home?login_error=true.

                    Tkx Steveits.

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by Jul 22, 2021, 2:50 PM

                      I opened a separate bug to cover this as it was getting conflated with the PHP issue whoch is a separate (and solvable) problem:
                      https://redmine.pfsense.org/issues/12157

                      Steve

                      1 Reply Last reply Reply Quote 1
                      • First post
                        Last post
                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.