Netgate SG-3100 "bans" access point
-
I have a Netgate SG-3100 and a couple of access points.
One of those is an Archer AX10 (static ip).
This access point get randomly "banned" (after 30 mins, 2 hours, a day).
What I mean is that the access point can't see the lan connection to the netgate anymore.
To fix it I have to restart the netgate. If i restart the Archer, or even reset it to factory, it won't see the network untill I restart pfsense.
I think that is happening since the last update 22.05-RELEASE, but I'm not sure.Btw other access points, different brands, in the network are fine.
-
@gich Doubltful it's the 3100 that's causing it -- What's in the pfSense firewall log? Are you running Suricata or Snort? Other packages? pfBlocker?
-
I have disabled all packages.
At the moment it's the most simple setup of pfsense.Cables are fine, if I plug a notebook it work without a problem.
I can't find anything relevant in any log.
-
@gich If there's nothing in the logs showing things blocked (check the Firewall log specifically) then it's the hardware that's the issue -- and that I mean the Archer AX10.
What can you do? Can you ping anything when on the wifi (I presume that's how you're connecting)? Can you ping the Archer?
When the Archer is misbehaving can you ping it when you plug directly into the switch ports on the 3100?
What version of pfSense are you running?
-
While it's "banned" I can access the Archer only directly: via any of its ethernet ports or from its WiFi.
It keeps its assigned ip (assigned from pfsense), unless I restart it.
From the rest of the net it's just dead.I got 22.05-RELEASE.
Archer is also on its latest firmware. -
@gich Please connect to another LAN port on the 3100 and try to ping the Archer and the pfSense LAN IP.
Assuming you set up VLANs on all the ports on the 3100 switch you can move ports.
Try swapping out cables.
-
@rcoleman-netgate The two aren't directly connected. There is at least an unmanaged switch in the middle.
Anyway tested different ports and cables.I think I'll move the Archer to a friend house, to test it with another router.
-
@gich Remove the unmanaged switch, then, too.
Troubleshooting includes replacing and swapping all things. There could be an ARP storm caused by the switch that is only effecting your AP.
-
@rcoleman-netgate I thought something that simple would be less likely to cause any problem.
It has a lot of things connected to it.
Anyway I'll try to bypass it. -
@gich There are 4 LAN ports on the 3100. If they're not changed from the default LAN interface you can plug into any of them.
But to state the 3100 "bans" a device that is multiple links down the chain is not likely at all. there would be a record in the system somewhere... unless the device in the middle is the one that is losing its place. MAC table corrupted, maxed out, ARP storm, switch is failing, etc.
The "simple" things are the ones most likely to cause a problem when they meet a challenge because they're simply not geared towards the expectations and performance of an active network. A cheap 8-port switch might have a 1k MAC table and that can fill in minutes or hours depending on how much is happening.
-
@rcoleman-netgate But it's not a new setup, everything is in place for more then 18 months.
I find odd that the thing that does the less complicated job starts to misbehave.
I thought since pfsense is the more complex piece, it was the most likely to have something gone wrong.Anyway, I'll try that to be sure.
-
@gich And hardware can (and will) fail. I would consider trying to reboot the intermediary switch next time instead of the pf and see if that resolves the issue.
-
@gich said in Netgate SG-3100 "bans" access point:
@rcoleman-netgate But it's not a new setup, everything is in place for more then 18 months.
I love when people say that. I must hear it 4 times a week.
I've been in the electronics field all my adult life. One thing never fails, you can take a piece of electronics right out of the box and have a resistor blow, or it could run "for 18 months" and have a resistor blow. Ya just don't know.
I always tell them, all electronic devices runs on smoke, once you let the smoke out, it won't work anymore!
-
@jarhead The switch has 7 more things plugged that have no problem.
I'm not saying it can't be the one that failed, but it's not at the top of my list.
I mean, if it was failing I'd expect something more noticeable.Restarting the switch did nothing.
Chronologically the last change was the update to pfsense, so that's why I'm here.
-
@jarhead Also remember that restarting pfsense, does put the Archer back in the game.
That's why I'd not focus elsewhere. -
@gich Without being willing to accept that something else might be causing the technical issue, or trying to do the recommended troubleshooting, will tend to others abandoning their attempts to assist you.
-
The only thing in a default pfSense install that could present like this is the sshgiard login protection.
When it appears to be 'banned' check Diag > Tables and look for any entries in the sshguard table. If the AP IP is shown there that would do it. It would get 'unbanned' after some time though.
Also that would only affect other devices connected to the AP if it was acting a as router and NATing all the traffic from wifi clients.Steve
-
@rcoleman-netgate Did you miss the "I'll try that to be sure" ???
I was explaining why I was pointed in another direction. -
There are some tests we can do to be sure. It 'feels' like a rogue dhcp server or IP conflict though.
-
So I tried to connect directly to the Netgate via another port. Nothing.
Then I removed the static ip on it and, while I was looking around, I had a glimpse on the ARP table of a "incomplete MAC".
WTF is that? Busted port? But it works when I connect the notebook.So since it was already planned: moved the Archer to a friend house, very basic setup, and it works fine for hours.
While this was going on I resetted the Netgate and reloaded the configuration just backupped.
Archer is back at home where it was before and going strong all night.Early to tell if this is definitive, since it might have worked for that long before, but I'm hopeful.
Still no idea if the "incomplete MAC" was real or a dream and what that might mean.
