IPsec (VTI) memory leak.
-
Hi. I had a pfsense box at a remote site crash on me today. I suspect there is a memory leak relating to the implmentation of IPsec on pfSense.
I run a VTI tunnel back to my core router. I enabled a giant new recurring backup job yesterday. The backup job began at 11:30 PM.
Core router:
Branch router:
My core router was able to handle the additional load; as you can see the branch router did not. How can I confirm that this is indeed related to a memory leak? Thanks.
-
To get a better idea, you will need to check and track the usage of individual processes over time.
Just because the data is flowing over IPsec doesn't necessarily mean it's directly related to IPsec.
Also, FreeBSD will attempt to use as much RAM as possible for things like caching, because free RAM is wasted RAM. It's normal for RAM usage to be high. You need only worry when processes start crashing/dying.
-
@jimp So I don't have definitive proof but both my core router and branch router started swapping out. My branch router filled up its swap then crashed. My core router would have crashed also but it has 32 GB of RAM while my branch router only has 16 GB of RAM. The memory usage tracks exactly with the backup job.
Core router memory overview including swap usage:
Branch router memory overview including swap usage:
For the time being I am moving all my tunnels that I can over to OpenVPN. This is unfortunate as OpenVPN does not get good performance and I have some remote sites with Fortigate firewalls. Fortigate does not support OpenVPN.
