Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    CARP issues

    Scheduled Pinned Locked Moved
    Virtualization
    2
    23
    2.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      steve40
      last edited by

      Hello,

      thanks again for responding. I'm uploading a tcp dump taken off the outside interface
      there are two packet captures. the first was taken while it's working and the second when it stops.
      I've also included my config.xml, loader.conf outpout of sysctl and ifconfig and pciconf files and attached the log file generated around the same time

      thanks 0_1532554827846_debug.tar 0_1532554834563_logs.txt

      1 Reply Last reply Reply Quote 0
      • S
        steve40
        last edited by

        Oh, and sorry for not specifying. The packet captures and other files are in the debug.tar file and the log is in the other file

        thanks again

        1 Reply Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate
          last edited by

          Please download and post actual pcaps so wireshark can do the heavy lifting.

          Thanks.

          Also please describe exactly what is "working" and what isn't. Like what traffic to actually look at.

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • S
            steve40
            last edited by

            I'm posting a capture of the pfsense capture as it's working. meaning, this is the gateway I am literally connecting to this forum right now through .. I've got a continuous ping running to 8.8.8.8 as well. I about 5 minutes I'll be posting the capture taken when it stops working [0_1532557784353_while-working.cap](Uploading 100%)

            1 Reply Last reply Reply Quote 0
            • S
              steve40
              last edited by

              0_1532557838891_while-working.pcap

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                You might want to set the pcaps to more than 100 frames.

                That showed one request and one reply and no CARP.

                The best thing to have in your case is probably a transition from working to not working. 10000 frames, 100000 frames. Whatever it takes.

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                S 1 Reply Last reply Reply Quote 0
                • S
                  steve40 @Derelict
                  last edited by

                  0_1532558535343_when-its-broken.pcap

                  1 Reply Last reply Reply Quote 0
                  • S
                    steve40
                    last edited by

                    0_1532558669575_whenitworks.pcap

                    1 Reply Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate
                      last edited by Derelict

                      Is there a package you haven't installed?

                      It also appears you are playing fast and loose with what is and isn't RFC1918.

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by Derelict

                        I see nothing in those captures to indicate a problem.

                        "when-its-broken" When exactly WHAT is broken?

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • S
                          steve40
                          last edited by

                          Can no longer connect to the internet and the continuous ping comes to an immediate halt

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            Cannot connect to the internet from where and continuous pings to what? What does cannot connect mean? DNS resolution? HTTP? HTTPS? What? To where? From where?

                            Sorry, but you are going to have to be far more specific. From what you have posted it looks like there is no problem on the WAN.

                            I am fairly sure this is an issue in your virtual environment/switching that will not be solved by changing anything in the firewall settings.

                            https://www.netgate.com/docs/pfsense/routing/connectivity-troubleshooting.html

                            https://www.netgate.com/docs/pfsense/highavailability/troubleshooting-high-availability-clusters.html

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • DerelictD
                              Derelict LAYER 8 Netgate
                              last edited by

                              OK so it looks like there is no response to traffic when it is "broken" and the source is the CARP VIP. But the traffic is going out and there is no reply. You will need to investigate upstream and see why that is.

                              I don't see any ARP requests for the CARP VIP, and certainly none that are going unanswered.

                              So, it still points to something upstream probably in your layer 2.

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 0
                              • S
                                steve40
                                last edited by

                                Gone through 3 switches now. 1 TP-link and two Cisco catalyst 2960G both reset to factory defaults running a completely vanilla out of the box config.

                                1 Reply Last reply Reply Quote 0
                                • DerelictD
                                  Derelict LAYER 8 Netgate
                                  last edited by

                                  And?

                                  Look at this file you sent: 1532558530465-when-its-broken.pcap

                                  Set a wireshark filter for icmp

                                  Start at frame 183 and look through frame 212.

                                  When the traffic is sourced from .172 (the CARP VIP) there is no response but the traffic IS being sent.

                                  When the traffic is sourced from .173 (the interface address) there is a response.

                                  You have to figure out what is going on UPSTREAM of the firewall that causes this to be true.

                                  I am going to move this to the Virtualization forum because that is where I'll bet your problem is. Some setting in the hypervisor. Maybe it will only allow one active MAC address on the interface at a time or something.

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • S
                                    steve40
                                    last edited by

                                    Ok. Thanks for the reply

                                    Does anyone on the virtualization side have any ideas? Ive done pci passthrough via hostdev in libvirt xml and pci stubs in grub. Im under the impression that since the OS has no knowledge of the NIC card then neithier does libvirt since its a user space app. As i posted ealier freebesd sees the actual intel chipset instead of the standard e1000 emulated chip that QEMU provides to the guest. Also the mac addresses that pfsense sees on the NICs are those that are hardcoded on the hardware Additionally, the xml config has no entry for these nics and the centos cant even bring them up via ifup as the driver has never bound itself to the card.

                                    Maybe im missing something on the hypervisor side here but im under the impression that atandard anti spoofing mac address feature shouldnt apply here since libvirt is unaware of the existence or the card. Or is it?

                                    Thsnks

                                    1 Reply Last reply Reply Quote 0
                                    • First post
                                      Last post