Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    CARP issues

    Scheduled Pinned Locked Moved
    Virtualization
    2
    23
    2.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DerelictD
      Derelict LAYER 8 Netgate
      last edited by

      Please download and post actual pcaps so wireshark can do the heavy lifting.

      Thanks.

      Also please describe exactly what is "working" and what isn't. Like what traffic to actually look at.

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      1 Reply Last reply Reply Quote 0
      • S
        steve40
        last edited by

        I'm posting a capture of the pfsense capture as it's working. meaning, this is the gateway I am literally connecting to this forum right now through .. I've got a continuous ping running to 8.8.8.8 as well. I about 5 minutes I'll be posting the capture taken when it stops working [0_1532557784353_while-working.cap](Uploading 100%)

        1 Reply Last reply Reply Quote 0
        • S
          steve40
          last edited by

          0_1532557838891_while-working.pcap

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            You might want to set the pcaps to more than 100 frames.

            That showed one request and one reply and no CARP.

            The best thing to have in your case is probably a transition from working to not working. 10000 frames, 100000 frames. Whatever it takes.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            S 1 Reply Last reply Reply Quote 0
            • S
              steve40 @Derelict
              last edited by

              0_1532558535343_when-its-broken.pcap

              1 Reply Last reply Reply Quote 0
              • S
                steve40
                last edited by

                0_1532558669575_whenitworks.pcap

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by Derelict

                  Is there a package you haven't installed?

                  It also appears you are playing fast and loose with what is and isn't RFC1918.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by Derelict

                    I see nothing in those captures to indicate a problem.

                    "when-its-broken" When exactly WHAT is broken?

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • S
                      steve40
                      last edited by

                      Can no longer connect to the internet and the continuous ping comes to an immediate halt

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        Cannot connect to the internet from where and continuous pings to what? What does cannot connect mean? DNS resolution? HTTP? HTTPS? What? To where? From where?

                        Sorry, but you are going to have to be far more specific. From what you have posted it looks like there is no problem on the WAN.

                        I am fairly sure this is an issue in your virtual environment/switching that will not be solved by changing anything in the firewall settings.

                        https://www.netgate.com/docs/pfsense/routing/connectivity-troubleshooting.html

                        https://www.netgate.com/docs/pfsense/highavailability/troubleshooting-high-availability-clusters.html

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • DerelictD
                          Derelict LAYER 8 Netgate
                          last edited by

                          OK so it looks like there is no response to traffic when it is "broken" and the source is the CARP VIP. But the traffic is going out and there is no reply. You will need to investigate upstream and see why that is.

                          I don't see any ARP requests for the CARP VIP, and certainly none that are going unanswered.

                          So, it still points to something upstream probably in your layer 2.

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • S
                            steve40
                            last edited by

                            Gone through 3 switches now. 1 TP-link and two Cisco catalyst 2960G both reset to factory defaults running a completely vanilla out of the box config.

                            1 Reply Last reply Reply Quote 0
                            • DerelictD
                              Derelict LAYER 8 Netgate
                              last edited by

                              And?

                              Look at this file you sent: 1532558530465-when-its-broken.pcap

                              Set a wireshark filter for icmp

                              Start at frame 183 and look through frame 212.

                              When the traffic is sourced from .172 (the CARP VIP) there is no response but the traffic IS being sent.

                              When the traffic is sourced from .173 (the interface address) there is a response.

                              You have to figure out what is going on UPSTREAM of the firewall that causes this to be true.

                              I am going to move this to the Virtualization forum because that is where I'll bet your problem is. Some setting in the hypervisor. Maybe it will only allow one active MAC address on the interface at a time or something.

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 0
                              • S
                                steve40
                                last edited by

                                Ok. Thanks for the reply

                                Does anyone on the virtualization side have any ideas? Ive done pci passthrough via hostdev in libvirt xml and pci stubs in grub. Im under the impression that since the OS has no knowledge of the NIC card then neithier does libvirt since its a user space app. As i posted ealier freebesd sees the actual intel chipset instead of the standard e1000 emulated chip that QEMU provides to the guest. Also the mac addresses that pfsense sees on the NICs are those that are hardcoded on the hardware Additionally, the xml config has no entry for these nics and the centos cant even bring them up via ifup as the driver has never bound itself to the card.

                                Maybe im missing something on the hypervisor side here but im under the impression that atandard anti spoofing mac address feature shouldnt apply here since libvirt is unaware of the existence or the card. Or is it?

                                Thsnks

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post