DHCP Pool Status My State: "communications-interrupted"

planedrop

Wanted to see if I could get some more info on this. Have an HA pair of 1541's in use, love them, have been using them for a long long time, and am 100% certain that HA is working as it should, yet I am still seeing this error on both nodes in the DHCP Pool Status.

To be clear:

State syncing is working
Settings syncing is working
NAT syncing is working
Firewall rule syncing is working
ETC

So I'm quite sure everything is setup correct, I've had the same config for over a year now, have failed over plenty of times for updates, etc.... without any issues.

I'll post a screenshot here, each node in the HA setup shows the exact same State, as in "My State" shows "communications-interrupted" on BOTH nodes. (interface name is blanked out)

planedrop

OK so I've got a tad more info to add to this, seems this has been the status of it since 4/7 which is when I updated our firewalls to the newer 23.01 release, so I'm guessing something within that borked things as I'm quite sure it was fine before hand.

Not sure what the update process would have changed though and in my lab environment with HA units, things are still fine after an upgrade.

nocternal

@planedrop I'm guessing you have restrictive firewall rules on each of these interfaces? More then just 'allow any any'.

I had the similar/same issues when moving to 23.01. See my post (and resolution) here:

https://forum.netgate.com/topic/177904/23-01-dhcp-failover-broken-work-around-included

planedrop

@nocternal I'm guessing I'm running across the same issue, thanks a ton for commenting and for posting this.

I do have same subnet from/to allow any rules on my networks, however they are below a deny everything to "This Firewall" on those subnets, so I am guessing it's not helping with DHCP and the ports you mentioned.

Moving that rule above the deny everything to "This Firewall" rule fixed it, so you're totally spot on here.

Looks like a fix will be coming at some point in the future too but at least now I know.

Thanks so much!

nocternal

@planedrop No worries. If you don't want to compromise your firewall security you can install the 'System patches' plugin and apply the code (as referenced in the other post).

This would allow you to keep your firewall rules in place. You can remove the patch once the next release of Plus comes out.

planedrop

@nocternal Yup, I'll be doing just that, super nice we can do "micro" patches like this.

Thanks again!!