Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    VLAN to VLAN stops for minutes at a time

    Official Netgate® Hardware
    2
    7
    364
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      milkman
      last edited by

      I am experiencing some seriously frustrating issues with my xg-7100-dt. At least once an hour, it simply stops forwarding packets from one VLAN to another (specifically to my DNS server on the other VLAN). Wireshark shows the packets leaving the interface on one machine, but doesn't show those packets on the DNS server's interface. After several minutes (yes, minutes), it suddenly starts working perfectly again. Am I the only one seeing this? I am about to replace the Netgate with another system to ensure the issue is absolutely the Netgate, but given both machines are directly connected to the Netgate, and wireshark is seeing the packets leave one interface, but not seen at the other...it really seems damning.

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        Are those VLANs configured on the Eth ports on the XG-7100?

        Is it only DNS traffic that seems to not be routed?

        Do you see anything blocked in the firewall log when this happens?

        I would certainly try running a packet capture on pfSense on the VLAN interfaces in question to see what is visible there.

        Steve

        1 Reply Last reply Reply Quote 0
        • M
          milkman
          last edited by

          Yes, have two of the eth ports on their own VLAN (the only "VLAN" defined, the other ports are all on the default VLAN that is "LAN," hope that makes sense).

          No, not just DNS, it appears all TCP and UDP packets are not being forwarded from the VLAN to the main LAN machine. The machine on the VLAN has no problems reaching the WAN (it's packets continue to get properly routed to the WAN).

          Haven't seen anything in the firewall log yet, but haven't "found the problem" immediately, and the log has rolled on (it is a very busy log, lots of nasty packets coming in from the wild, wild west that is the internet).

          Ran packet captures, see the inbound packets on the VLAN interface, they are not being sent out the LAN interface.

          1 Reply Last reply Reply Quote 0
          • M
            milkman
            last edited by

            (ICMP also not being forwarded)

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Is there any other path between those VLANs? Something multihomed perhaps?
              I could imagine asymmetric routing behaving like that.

              I assume you are not NATing that traffic between the VLANs?

              Can you send traffic in the other direction when this happens?

              If you run a packet capture on WAN do you see the traffic leaving there instead on LAN?
              That might imply it's being incorrectly policy routed.

              Steve

              1 Reply Last reply Reply Quote 0
              • M
                milkman
                last edited by

                Wow, looks like someone had changed the power settings on the DNS server, it was suspending. It's always the simplest things that take forever to find.

                1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  Ha, nice catch though!

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post