Testing strategy for Plus versus CE
-
I have some official Netgate hardware in active service: a HA pair of XG-1537 and a standalone SG-3100. No support contract, as we've never seen the need.
These boxes haven't been upgraded for the last 18 months, due to Covid and limited data centre access.
Now I'm in something of a quandry. These boxes are offering upgrades to pfSense Plus 21.02_1 - but since pfSense Plus has forked from CE, I have no way of testing this prior to deployment. Previously I would have tested the free version of pfSense on a physical server or virtual machine, but it's not the same thing any more.
We do have some slightly unusual but important config, such as using the OpenBGPD package for handling failover of AWS tunnels.
I wonder how others are dealing with this - or whether Netgate has some solution for its paid-support customers, to test pfSense Plus outside of official hardware? Is the solution simply "buy more boxes"?
Alternatively, do people feel that Plus and CE are still sufficiently close to each other that this doesn't really matter? Web UI aside, are 21.02_1 and 2.5.1 the same internally, particularly with regard to kernel, pf rulesets, packages, and IPSEC handling? I note that there is a single release-notes page for both these versions. A white-box PC I have running 2.4.4-RELEASE-p3 is currently offering to upgrade to 2.5.1 (*).
Thanks,
Brian.
(*) I also see that CE 2.5.2 and Plus 21.05/21.05.1 have since been released, but upgrades to those are not being offered. Maybe the upgrade has to be done in stages.
-
This is a great question.. Pfsense+ is to be released for your own hardware/virtual at some point. The blog mentioned June of 2021 - which has hit a snag.. But latest I have seen is it is still planned just behind schedule is all.
If you want to do testing before update of production systems (always a good idea) - it is prob prudent to just wait until this is available.
I don't think there is much divergence as of yet, and seems if anything some stuff has been corrected in + before CE.. But if you are running stuff with some unusual configurations, I would prob just wait for ability to test on different hardware/virtual - or when you have a sufficient window to be able to do full testing inside your change window and ability to rollback if needed. I have some 3100s in locations that have really been unmanned since covid that also behind.. They are pretty vanilla installs, and while production - not critical production. But I have been holding off update until can be onsite..
There was some issues with 3100 I do believe that was corrected in the latest 21.05.1 release. So its prob a good thing you waited, I believe at one point the update availability was even halted for the ARM based stuff..
As to what 3100 might be showing for update - Mine is not showing any update, I believe you might have to change the branch.. You can see mine are not even at 2.4.5
While I would normally be current - the state of the world has put some things on the back burner for sure and without any specific need to upgrade, and no ability to be onsite or even have smart hands these will just have to wait..
If I change the branch - it shows that 21.09 dev is available..
If I was going to update today - I would most likely just do clean install with 21.05.1 image you can obtain via email/ticket to netgate.
-
@johnpoz: many thanks for the helpful reply.
Here's what I see for upgrade branches on the 3100:
So it considers 21.05.x "experimental" at this point.
CE shows this:
-
That is a bit odd, mind doesn't show that 21.02.2-RC -- hmmm
Wonder why we are not seeing the same thing? If I change my branch to 21.02 I see 21.02.2 as available
-
Yes that's odd. On the front page of the SG-3100:
Pressing that 'reload' icon doesn't change it. -
Mine shows .2
Might have to do with the state of pkg updates - I believe you can run a cmd line pkg update.. But to be honest - currently I don't want to mess with anything.. While the location is not really staffed at the moment... I don't want really want to mess with this system at all until I can be onsite, there are few people in and out and this system is firewall/router internet for wireless.. They would prob be a bit upset if I broke that ;)
edit: If my decision, I would hold off until you can do enough testing to give you piece of mind that new version will work with your configuration. Unless there is something driving need to update? If this was home/lab I would say just go for it ;) But if any sort of production system, caution is always best..
-
It shows that because you're on a version that is now several versions old. It needs to update the package that contains the available repos but can't get the latest version of that from the 2.4.4 branch.
If you run the update though you will probably go straight to 2.5.2 or 21.05.1 since it will be able to update the repo package as soon as it starts to pull in new packages.Steve
