VEEAM can't restore pfSense VMs ???

avantsysadm

Hi,
We're running several instances of pfSense (community edition) deployed from the (gold-membership-only) .OVA template, on a vSphere 6.0 cluster. All are running at least 2.4.2-RELEASE, most are newer. Some were deployed in the 2.3 era, some in the 2.4 era (AFAIK).

VEEAM, an otherwise reasonably decent backup solution for VMware, backs up all of our VMs.
VEEAM can restore any of the Linux VMs, OpenBSD VMs, or FreeBSD VMs... but not the pfSense VMs - not one of them, they all fail the same way after being restored.

Every time we attempt to restore a pfSense VM, the restored VM fails to boot, with:

===START===
GEOM: da0: corrupt or invalid GPT detected.
GEOM: da0: GPT rejected -- may not be recoverable
mountroot: waiting for device /dev/gpt/pfSense...
Mounting from ufs:/dev/gpt/pfSense failed with error 19.

Loader variables:
vfs.root.mountfrom=ufs:/dev/gpt/pfSense
vfs.root.mountfrom.options=rw
[...and then the usual bootloader stuff...]
===END===

All the VMs have UFS roots, not ZFS. I thought pfSense switched to ZFS by default in 2.4? It's possible all the VMs were deployed in the 2.3 era.

This has been observed with every pfSense VM we've deployed from the OVA file.

All our attempts to replicate it with FreeBSD have failed, but of course those are being installed in a different way so I'm unsure if the results are directly transferable.

Our VEEAM support has assured us that the entire (sparse) disk image is being backed up and restored, it's not doing something silly like trying to do a filesystem backup. I think the FreeBSD-only tests would tend to support that, since their GPT structures are intact post-restore.

has anyone seen anything like this?
any suggestions for how to continue troubleshooting this?

Thanks,
-Adam

mephisto

We had the same issue here, restoring from Veeam always get the filesystem screwed with Veeam and VMware

avantsysadm

Solution found: reinstall the affected firewall(s) from .ISO.

The VEEAM backup/restore problem only affects firewalls deployed through the .OVA template.

Root cause still unknown.

avantsysadm

It's fairly clear now that the VMware appliance template has been discontinued, but I've still documented the problem at https://redmine.pfsense.org/issues/8787 in case anyone else suddenly runs into this!

RushB Jack

This post is deleted!