pfSense keeps disconnecting/reconnecting in UniFi Controller

dragonfire1119 · Aug 28, 2021, 2:02 AM

@stephenw10 I'm seeing in the events on Unifi it's saying my "Netgate disconnected from LAN or Guest Network" (34m connected, 71.5 KB, last) AP.

Not sure if this is normal or not though?

I talked with UI Support and they kept wanting to troubleshoot the wifi, I don't think this has anything to do with wifi?

My Unifi Controller is a Raspberry PI hooked up to my Unifi Switch 48 port and all AP's are hooked up to the same 48 port switch.

Netgate XG-1541 > Unifi 48 Port

AP's 4 of them > Unifi 48 Port

Unifi Controller > Unifi 48 Port

Thanks for the reply.

johnpoz · Aug 28, 2021, 7:17 AM

@dragonfire1119 are you using any sort of lagg or lacp to connect 1541 to the switch?

Are you using any sort of tags, guest network is another vlan? Your saying the netgate is being seen on 2 different vlans?

Netgate disconnected from LAN or Guest Network"

So more details on your actual physical connections/tags/interfaces and setup could be helpful

dragonfire1119 · Aug 28, 2021, 3:18 PM

@johnpoz

Netgate LAN Port > CAT 6 > 48 Port Switch - SFP+ 1G

VLAN's

LAN - Default VLAN 1
C Network - VLAN 5
IOT Network - VLAN 10
Guest Network - VLAN 30

Almost all these VLANs are a separate network on Unifi as VLAN Only networks.

Unifi Networks

LAN - Default VLAN 1 - Main LAN - Corporate
C Network - VLAN 5 - VLAN Only
IOT Network - VLAN 10 - VLAN Only
Guest Network - VLAN 30 - VLAN Only

Thanks for the help!

johnpoz · Aug 28, 2021, 3:26 PM

@dragonfire1119 did you mean LAN port there - not wan?

You might need to get with unifi forums or support or docs on how unifi determines some device is connected or disconnected..

Your problem sounds related to the OP where all of those vlans will be sharing the same mac.. Not sure how unifi handles seeing the same mac on multiple networks when you have 1 of their switches in the network..

I don't have a unifi switch on my network. So the unifi controller doesn't show me any wired devices only wireless. Hmmm wonder if I could pick up 1 of their cheap $30 switches to play with - have to see if those can be added to the controller to show me wired devices - then I could try and duplicate this sort of problem.

edit: Or maybe their cheap poe one - then I could get rid of my injectors atleast ;)
edit2: Hmmm have to rethink the poe idea.. 1 of the AP I would want to power is OLD lite model before they added 802.3af support. Mine is one of the passive only models.. hmmmm Plus the 100$ poe switches seem to be back ordered anyway..

dragonfire1119 · Aug 28, 2021, 3:28 PM

@johnpoz Ya my bad LAN. Programming and responding don't always work out. LOL It's only doing it on certain networks. The really active IoT Network never shows disconnected for some reason. Not sure about the Mac Address idea.

Ya UI Products are always out of stock.

johnpoz · Aug 28, 2021, 4:25 PM

@dragonfire1119 So just ordered the USW-Flex-Mini, figured I could swap out the for the old smart netgear I have behind my tv.. Give me a way to play with switch in my controller.. Should be here monday.

It was a bit more on amazon.. But comes out a few dollars cheaper than paying for shipping on ui store.. Let you know if I find anything once I play with it for a bit.

edit:

The really active IoT Network never shows disconnected for some reason

Yeah I wonder if doesn't see mac in X amount of time if marks it disconnected. Can play with that for sure by bringing up device in specific vlan that unifi switch will see, and then turning off client in that network that would be talking to pfsense.. And see if it then say pfsense disconnected after X amount of time.. Curious to play with the switch in the controller for a few different things.. Even if I end up hating it - can swap it out for the dumb switch have at my sons house, his usg and flexHD ap report to my controller. $38 well spent for play time.. hehehe

dragonfire1119 · Aug 28, 2021, 5:51 PM

@johnpoz Cool thanks for trying to help and your time on this! Ya, I was thinking that might be it but my LAN network gets used a lot so not sure.

johnpoz · Aug 28, 2021, 6:01 PM

@dragonfire1119 how often does it happen? Do you have a rough number - does it happen once a day, does it cycle on and off all the time? Like its log spam? Does it happen just now and then?

dragonfire1119 · Aug 28, 2021, 6:03 PM

@johnpoz happens every 4 to 10 mins sometimes like clock work sometimes skips a few.

johnpoz · Aug 28, 2021, 6:18 PM

And if you get say a constant ping going from something in that vlan to the pfsense IP in that guest or lan... Does it not do it? Do pings fail?

dragonfire1119 · Aug 28, 2021, 9:06 PM

@johnpoz I've set up a ping test on my mac for a day and no packet loss.

johnpoz · Aug 29, 2021, 2:10 AM

@dragonfire1119 and while you were pinging - did it still say it disconnected?

dragonfire1119 · Aug 30, 2021, 3:52 PM

@johnpoz Yes, it did.

johnpoz · Aug 30, 2021, 4:03 PM

@dragonfire1119 so you never lost a ping, yet the controller was saying that IP was disconnected?

Hmmm that is strange.. What really need to understand is how unifi determines if something is disconnected or not. The only way I could see it doing it for something that is not wireless is mac address in the table..

One theory is arp table on controller, or whatever table it uses for clients is only updated on arps? So its quite possible for arp table on device to be longer than controller, so while the client knows where to send the pings, it doesn't have to arp for X minutes. But controller looses this entry when its table expires and doesn't refresh until it sees an arp again.

My switch should be here today.. Atleast then I will have a way to try and duplicate your problem. I will see if I can find any info/doc on how exactly unifi determines if something is disconnected.

NGUSER6947 · Aug 30, 2021, 4:21 PM

I have a Netgate SG-1100 -> Unifi Switch -> Unifi AP

No problems. I'd arrange in the same order I have and see if that resolves the issue.

dragonfire1119 · Aug 30, 2021, 4:40 PM

@johnpoz I'm noticing my Echo's are disconnecting when the event happens with it showing disconnected from the Netgate. Not sure if this issue is why I'm having music streaming issues going in and out then it completely stops sometimes.

With the Unifi I'm guessing if the LAN disconnects it disconnects my VLAN Networks since the LAN is the main Network?

I'm using the DHCP server on Netgate all Unifi uses are Switches and AP's and gets all ip's from Netgate.

johnpoz · Aug 30, 2021, 4:46 PM

@dragonfire1119 said in pfSense keeps disconnecting/reconnecting in UniFi Controller:

With the Unifi I'm guessing if the LAN disconnects it disconnects my VLAN Networks since the LAN is the main Network?

Thought you never lost a ping? Then it wasn't actually disconnected - how could it have been if you didn't loose a ping? Was the disconnection less then 1 second and happened inbetween pings? That seems highly unlikely.. especially if you had multiple disconnects.

dragonfire1119 · Aug 30, 2021, 5:17 PM

@johnpoz I checked ping on my Macbook Pro over two nights and never lost a packet. When I'm surfing on the web sometimes google will just load and load until I disconnect then reconnect and it's fine again.

I can't test ping on my echo's but they're giving me problems not sure if it's WiFi or something else. We have had the Wifi working just fine for a year but that was without the fiber service we have now. I've factory reset the echo's nothing has really helped them disconnecting or dropping out on music streaming.

I'm trying to diagnose things but I'm not sure if these messages are to do with any of these issues that I'm having? I haven't gotten a clear reason why these messages even show up from Ubiquiti and my own research.

When these disconnects are happening this Netgate forum comes up on the bottom right and says something about Network error? This message on the bottom right doesn't stay for long though it's around just a second. Looks like it can't connect to the WebSocket/polling server on the Network tab.

I'm getting 900s directly off the Netgate so it's not my ISP.

I set up ping tests on my Home Assistant and it hasn't gone down but that's directly hard wired on my switch.

Update:

These are the new things that I have changed on the Network since our new internet:

Removed the UDM Pro
Changed over to using Raspberry PI 4+ 8GB for the Unifi Controller.
Hooked up the Netgate XG-1541 to the Unifi 48 Port Switch.
Added VLANs for Guest Network and IOT Network with isolating those from the Main Network.

dragonfire1119 · Aug 30, 2021, 6:44 PM

@johnpoz I noticed another thing that happens in the Netgate logs it's blocking my WAN IP for abuse 1.

Aug 30 13:31:59 sshguard	84939	Blocking "(My IP)" for 160 secs (1 attacks in 0 secs, after 1 abuses over 0 secs.)
Aug 30 13:31:59	sshguard	84939	Attack from "(My IP)" on service SSH with danger 10.
Aug 30 13:31:59	sshd	84405	Did not receive identification string from (My IP) port 46863

This is happening right around the time. I'm not sure why this happens since I'm new to Netgate? ntopng is fine on the flows.

johnpoz · Aug 30, 2021, 6:54 PM

Its blocking your lan IP? Why are you trying to login to ssh without sending the correct info?

I can generate those on the fly by trying to connect to ssh from a box on my network - but I have public key auth setup

Aug 30 13:52:35 	sshguard 	81488 	Attack from "192.168.2.12" on service SSH with danger 2.
Aug 30 13:52:35 	sshd 	83302 	Connection closed by authenticating user root 192.168.2.12 port 34882 [preauth]
Aug 30 13:52:34 	sshguard 	81488 	Attack from "192.168.2.12" on service SSH with danger 2.
Aug 30 13:52:34 	sshd 	82979 	Connection closed by authenticating user root 192.168.2.12 port 34880 [preauth]
Aug 30 13:52:32 	sshguard 	81488 	Attack from "192.168.2.12" on service SSH with danger 2.
Aug 30 13:52:32 	sshd 	82701 	Connection closed by authenticating user root 192.168.2.12 port 34878 [preauth]
Aug 30 13:52:30 	sshguard 	81488 	Attack from "192.168.2.12" on service SSH with danger 2.
Aug 30 13:52:30 	sshd 	82337 	Connection closed by authenticating user root 192.168.2.12 port 34876 [preauth]
Aug 30 13:52:26 	sshguard 	81488 	Attack from "192.168.2.12" on service SSH with danger 2.
Aug 30 13:52:26 	sshd 	80674 	Connection closed by authenticating user root 192.168.2.12 port 34874 [preauth]

root@192.168.2.253: Permission denied (publickey).
root@NewUC:/home/user# ssh 192.168.2.253
root@192.168.2.253: Permission denied (publickey).
root@NewUC:/home/user# ssh 192.168.2.253
root@192.168.2.253: Permission denied (publickey).
root@NewUC:/home/user# ssh 192.168.2.253
root@192.168.2.253: Permission denied (publickey).
root@NewUC:/home/user# ssh 192.168.2.253
root@192.168.2.253: Permission denied (publickey).
root@NewUC:/home/user#