Auto configuration backup shows no backups

[rahvin9999]

@steve_b

Resolves and succesfully pings to 208.123.73.78 from pfSense1, pfSense2 and pfSense3

64 bytes from 208.123.73.78: icmp_seq=0 ttl=45 time=122.599 ms
64 bytes from 208.123.73.78: icmp_seq=1 ttl=45 time=122.372 ms
64 bytes from 208.123.73.78: icmp_seq=2 ttl=45 time=122.598 ms
64 bytes from 208.123.73.78: icmp_seq=3 ttl=45 time=122.429 ms

[Steve_B]

@rahvin9999 The logs show a few instances of you attempting to list backups for firewall 1 (presumably when testing from another firewall) but no backups being saved.

It is possible this could be due to an error in your HA configs but that is just a guess. We are discussing internally.

[stephenw10]

Yes, a common config mistake here is to end up with HA nodes NATing their own traffic whifh can cause a problem. However I don't think that can be the problem here because each node is able to ping the acb server and can list the backups from the third firewall.

@rahvin9999 said in Auto configuration backup shows no backups:

Our config.xml files are 16.748KB

Is that nearly 17MB? That would be a really very large config, we might need to test that.

Steve

[rahvin9999]

@steve_b

From my perspective the HA config works without issues.

High Availability Sync settings on pfSense1

• pfsync is configured to sync states over a dedicated sync interfaced targeted to the IP of pfSense2
• XMLRPC Sync is configured to sync to pfSense2 on the same ip as pfsync
• XMLRPC Sync uses the admin user and everything is ticked to be synced except Synchronize admin
• we have HAProxy installed and this is set to use XMLRPC Sync via the HAProxy settings page setting "HAProxy Sync"

High Availability Sync settings on pfSense2

• pfsync is configured to sync states over a dedicated sync interfaced targeted to the IP of pfSense2
• the XMLRPC Sync section is left empty

We have 3 Carp VIP's

• WAN has one Carp VIP in a /29 subnet
• LAN has one Carp VIP in a /24 subnet
• DMZ has one Carp VIP in a /24 subnet

The config is succesfully synced from pfSense1 to pfSense2
If on pfSense1 I:

• Disable CARP (or)
• Enable CARP Persistent maintenance mode (or)
• Pull the powercable from pfSense1
  pfSense2 takes over everything. We have a lot of OpenVPN and IPSec clients. Who succesfully reconnect to pfSense2.
  If I boot/reenable pfSense1 everything goes back to pfSense1

[rahvin9999]

@stephenw10

Yes, that is nearly 17MB.

We currently have 3000+ Users, Certificates and OpenVPN Client Specific Overrides in the config.

Only issue that many users and certificates gives is, that some pages take some time to load.
That and rebooting takes some time as it is stuck at "Synchronizing users settings" for a while.
But that is due to the fact that the xeon D cpu used has horrible single thread performance. If I load this config on a server with a faster CPU it loads multiple factors faster.

<edit: Spelling and grammar>

[stephenw10]

Ok, that is very large. We are checking on that now but I suspect you are hitting a config size limit.

I would usually recommend using external authentication by the time you're approaching that many users. There are certainly parts of the gui that will struggle with that number of entries.

Steve

[Steve_B]

Would you try a backup now please?

[rahvin9999]

@steve_b

Did a test backup on both pfSense1 and pfSense2 and they now show up in the list.

Bedankt!

[Steve_B]

Glad it worked. As @stephenw10 said, an external authentication system would be worthwhile for that many users, but in the meantime I increased the max file size to 30 MiB.

[rahvin9999]

@steve_b

I am looking into moving the users and the certificates of the pfSense machines to a dedicated solution.

Thanks for the help with this issue!