VLAN to VLAN stops for minutes at a time
-
I am experiencing some seriously frustrating issues with my xg-7100-dt. At least once an hour, it simply stops forwarding packets from one VLAN to another (specifically to my DNS server on the other VLAN). Wireshark shows the packets leaving the interface on one machine, but doesn't show those packets on the DNS server's interface. After several minutes (yes, minutes), it suddenly starts working perfectly again. Am I the only one seeing this? I am about to replace the Netgate with another system to ensure the issue is absolutely the Netgate, but given both machines are directly connected to the Netgate, and wireshark is seeing the packets leave one interface, but not seen at the other...it really seems damning.
-
Are those VLANs configured on the Eth ports on the XG-7100?
Is it only DNS traffic that seems to not be routed?
Do you see anything blocked in the firewall log when this happens?
I would certainly try running a packet capture on pfSense on the VLAN interfaces in question to see what is visible there.
Steve
-
Yes, have two of the eth ports on their own VLAN (the only "VLAN" defined, the other ports are all on the default VLAN that is "LAN," hope that makes sense).
No, not just DNS, it appears all TCP and UDP packets are not being forwarded from the VLAN to the main LAN machine. The machine on the VLAN has no problems reaching the WAN (it's packets continue to get properly routed to the WAN).
Haven't seen anything in the firewall log yet, but haven't "found the problem" immediately, and the log has rolled on (it is a very busy log, lots of nasty packets coming in from the wild, wild west that is the internet).
Ran packet captures, see the inbound packets on the VLAN interface, they are not being sent out the LAN interface.
-
(ICMP also not being forwarded)
-
Is there any other path between those VLANs? Something multihomed perhaps?
I could imagine asymmetric routing behaving like that.I assume you are not NATing that traffic between the VLANs?
Can you send traffic in the other direction when this happens?
If you run a packet capture on WAN do you see the traffic leaving there instead on LAN?
That might imply it's being incorrectly policy routed.Steve
-
Wow, looks like someone had changed the power settings on the DNS server, it was suspending. It's always the simplest things that take forever to find.
-
Ha, nice catch though!
