GW configuration - some questions
-
@empbilly said in GW configuration - some questions:
I couldn't find an option where I could specify the vlan for packet capture.
This should be possible in the capture configuration. Isn't there any interface setting?
Can it be with all traffic?
Yes.
Run the capture on the port which your PC is connected. Start it and try to ping a CARP VIP.
If the IP isn't in the PCs ARP table there should be an ARP request and a response in the capture. But presumably it doesn't get a response.Then run a capture on the port which is connected to pfSense to see if the request is passed through.
-
I have configured VIP CARP of vlan IOT as GW in dhcp. The file below is from a direct capture from pfsense.
packetcapture.cap@viragomann said in GW configuration - some questions:
Then run a capture on the port which is connected to pfSense to see if the request is passed through.
Tomorrow I will do that part.
-
@empbilly said in GW configuration - some questions:
I have configured VIP CARP of vlan IOT as GW in dhcp.
And which IP are we lookinf for?
-
vlan IOT: 10.10.56.0/27
VIP CARP/GW: 10.10.56.1
DHCP server/interface: 10.10.56.2 (pfmaster)Test from IP: 10.10.56.13
-
@empbilly
So you can see the ARP requests for the VIP and responses with the CARP MAC.
If these responses reach the device at 10.10.56.13, it should add the MAC to its ARP table.But obviously there is something going wrong. Even though there are ARP requests and correct responses for the CARP, the VIP is never addressed.
-
@viragomann said in GW configuration - some questions:
Even though there are ARP requests and correct responses for the CARP, the VIP is never addressed.
That is not good!!! :(
Yesterday I tried disabling the IGMP protocol on the switch, but anyway, I still can't get internet access when I configure VIP CARP as GW in DHCP.
I made new packet captures and they seem to say the same thing as the one above that I shared.
I would have to disable IGMP on all the switches in our infrastructure, correct?
EDIT1:
Anyway I disabled IGMP Snooping on the switches connected from our NOC to our office, but it still didn't go. Either they don't support the CARP traffic or there is some configuration to be done. -
@empbilly
To you see the ARP responses from 10.10.56.1 also on 10.10.56.13?
And if so, do you see the entry in its ARP table?If the ARP responses from the VIP reache the device, the issue can't be caused by the switch.
Is it the same result if you try to access a CARP VIP from another device?
-
@viragomann said in GW configuration - some questions:
To you see the ARP responses from 10.10.56.1 also on 10.10.56.13?
And if so, do you see the entry in its ARP table?10.10.56.13, now .11 is my celphone
packetcapture.cap (new capture)
@viragomann said in GW configuration - some questions:
Is it the same result if you try to access a CARP VIP from another device?
From the machine I use for work, I can ping all the CARP VIPs.
In pfsense packet capture I have selected the vlan (ADM_LAN) corresponding to the IP of my work machine.
The result is below:
23 2.599865 10.60.0.7 10.10.56.1 ICMP 98 Echo (ping) request id=0x002a, seq=1/256, ttl=64 (reply in 24)
24 2.599953 10.10.56.1 10.60.0.7 ICMP 98 Echo (ping) reply id=0x002a, seq=1/256, ttl=64 (request in 23)
31 3.614359 10.60.0.7 10.10.56.1 ICMP 98 Echo (ping) request id=0x002a, seq=2/512, ttl=64 (reply in 32)
32 3.614376 10.10.56.1 10.60.0.7 ICMP 98 Echo (ping) reply id=0x002a, seq=2/512, ttl=64 (request in 31)
35 4.638379 10.60.0.7 10.10.56.1 ICMP 98 Echo (ping) request id=0x002a, seq=3/768, ttl=64 (reply in 36)
36 4.638397 10.10.56.1 10.60.0.7 ICMP 98 Echo (ping) reply id=0x002a, seq=3/768, ttl=64 (request in 35)If I configure it to capture packets from the IOT vlan and ping from my work machine to GW 10.10.56.1, nothing is captured.
But, I tried pinging another IP (10.10.56.7 - Solar Converter), it didn't ping, but the captured packets appeared.
62 13.745105 10.60.0.7 10.10.56.7 ICMP 98 Echo (ping) request id=0x002e, seq=1/256, ttl=63 (no response found!)
64 14.767583 10.60.0.7 10.10.56.7 ICMP 98 Echo (ping) request id=0x002e, seq=2/512, ttl=63 (no response found!)
67 15.791683 10.60.0.7 10.10.56.7 ICMP 98 Echo (ping) request id=0x002e, seq=3/768, ttl=63 (no response found!)
72 16.815664 10.60.0.7 10.10.56.7 ICMP 98 Echo (ping) request id=0x002e, seq=4/1024, ttl=63 (no response found!)
77 17.839493 10.60.0.7 10.10.56.7 ICMP 98 Echo (ping) request id=0x002e, seq=5/1280,Other information. I removed VIP CARP 10.10.56.1 from Virtual VIP, tried to ping from my machine and it did not ping. I reconfigured and it pinged.
-
EDIT:
-
Other information. I removed VIP CARP 10.10.56.1 from Virtual VIP, tried to ping from my machine and it did not ping. I reconfigured and it pinged.
-
show arp on n1524 shows:
#show arp Static ARP entries are only active when the IP address is reachable on a local subnet Age Time (seconds)............................. 1200 Response Time (seconds)........................ 1 Retries........................................ 4 Cache Size..................................... 893 Dynamic Renew Mode ............................ Enable Total Entry Count Current / Peak .............. 14 / 18 Static Entry Count Configured / Active / Max .. 0 / 0 / 16 IP Address MAC Address Interface Type Age --------------- ----------------- -------------- -------- ----------- 172.16.0.2 8444.6478.FE49 Vl1 Gateway 0h 0m 1s 172.16.4.49 20FD.F146.7102 Vl1 Dynamic 0h 2m 59s 172.16.4.56 D07E.28D5.9073 Vl1 Dynamic 0h 18m 13s 172.16.4.217 E4F0.04D8.8F21 Vl1 Local n/a 172.16.7.129 D07E.28D7.1A9D Vl1 Dynamic 0h 18m 41s 172.16.15.16 D07E.28E4.CD3D Vl1 Dynamic 0h 0m 14s 172.18.0.1 20FD.F150.1389 Vl900 Dynamic 0h 8m 28s 172.18.0.5 2401.C7B1.35C1 Vl900 Dynamic 0h 17m 22s 172.18.0.14 04DA.D206.F1C1 Vl900 Dynamic 0h 17m 11s 172.18.0.17 2401.C7B1.3541 Vl900 Dynamic 0h 3m 16s 172.18.0.21 04DA.D206.F4C1 Vl900 Dynamic 0h 13m 18s 172.18.0.29 E4F0.04D8.8F21 Vl900 Local n/a 172.18.0.252 8444.6478.FE49 Vl900 Dynamic 0h 0m 12s 172.18.0.254 0000.5E00.0118 Vl900 Gateway 0h 0m 40s 250.251.252.254 0202.BC80.0002 Management Dynamic n/aThe vlan 900 is the management vlan for the switches and is the native vlan on the uplink port. The only GW VIP CARP that shows on the arp is from this vlan.
172.18.0.254 0000.5E00.0118 Vl900 Gateway -
-
@empbilly said in GW configuration - some questions:
The vlan 900 is the management vlan for the switches and is the native vlan on the uplink port. The only GW VIP CARP that shows on the arp is from this vlan.
I don't expect to see other CARP VIP in the switch ARP table.
If the switch provides layer 2 for the devices it must not communicate with the VIPs of other subnets, but only its management subnet.
The connected devices need to access them, however, since they use them as gateways. -
@viragomann said in GW configuration - some questions:
I don't expect to see other CARP VIP in the switch ARP table.
ok.
Do I need to disable the IGMP protocol only on the switch that pfsense is directly connected to or do I need to disable it on the other switches in our infrastructure as well?
-
@empbilly
I would not expect that it even interferes with ARP in any way.
Maybe the switch would forward the CARP (VRRP) packets if IGMP is on, since they are multicasts, but CARP works obviously properly. But if it has an impact, disable it on the switch which is connected to pfSense should be sufficient. -
I am going over our entire topic and my settings and documenting them so that I don't get lost in what has been done.
The question below was answered by another user at the beginning of the topic.
Even if I haven't put pfbackup on the network yet, the GW CARP VIP should work?
