Setting host as Monitored IP makes it unreachable?

jobe

Hello,
in my setup I have a network interface dedicated to reach a single host on a different network. I set that interface configuring the IP and its related gateway, then I put the remote host IP in "monitor IP" field. With this setup, that host was not reachable from my network, neither with ping or other protocols like FTP; moreover, the firewall itself was not able to reach that monitor IP, so the gateway was marked as unreachable.
I tried then to disable the monitor IP feature for that gateway, and that host became reachable from my network, firewall included. Is it an expected behavior? Or I misconfigured something?

johnpoz

Well if the host doesn't answer ping then monitor would think the gateway is down and nothing would work. If you want to be able to monitor it has to answer ping and out of the box monitor will send a zero sized ping which some devices don't like and will not answer. You can adjust that.

jobe

I did not manage to get this working…Trying to ping with a zero sized ping (ping -s 0) gave the same behaviour, everything works until I set the remote host IP in "monitor IP" field.

In my environment I have a master-slave pfSense setup, with CARPs configured...maybe this causes the issue? [Previously I had another issue related to CARPs, solved with the help of this forum: https://forum.pfsense.org/index.php?topic=143072.0]

Here are the IPs involved:
10.2.14.251 - Physical IP address of master pfSense
10.2.14.253 - CARP address of the master/slave cluster
10.2.14.254 - Remote non-pingable gateway
10.2.14.212 - Remote host pingable IP. It becomes not pingable when it is set as "monitor IP" for .254 gateway.

Executing some tcpdumps [tcpdump -i igb5 host 10.2.14.212] , I noticed that with "Gateway monitoring" disabled, the system has this behaviour:

There are only interactions between CARP IP and and remote host IP.

With monitoring enabled, here is the result:

There are many attempts from the physical IP addres, that do not receive any answers from .212 .

Moreover, I noticed that this line is added to routing table when monitoring is enabled:

10.2.14.212	10.2.14.254	UGHS	2139	1500	igb5

Do you have any clue?

luckman212

This may help:

https://github.com/pfsense/pfsense/pull/4551