To do 23.09 or not? That's the question.

yon 0

if your need use X25519 for openvpn, then 23.09 default not support it

johnpoz

@yon-0 said in To do 23.09 or not? That's the question.:

then 23.09 default not support it

That is more of openvpn thing than any specific issue with 23.09 is it not?

yon 0

@johnpoz

need edit openvpn.inc file allow x25519 cert. delete pfsense limit it code. This is an example after deletion

foreach ($a_cert as $cert) {
		
		$properties = array();
		$propstr = "";
		$ca = lookup_ca($cert['caref']);
		$purpose = cert_get_purpose($cert['crt'], true);

yon 0

Also I can't find out why the LAN interface cannot be routed out of the WAN interface.

Screenshot of pf- Diagnostics_ Traceroute.jpg

mcury

Noticed two things.

If you upgraded from previous versions to 23.09, If you run zpool scrub pfSense, it will say that: Some supported and requested features are not enabled on the pool.
The pool was OK with 23.05.1, but now getting this message.
So, I decided to perform a clean install just to confirm and now this message is gone.

Second thing I noticed is that the storage IO is lower with this version, I'm not sure if its because I switched from ISC to KEA, but I'm getting around 40% reduction in the writes.

[23.09-RELEASE][root@pfsense.home.arpa]/root: iostat -x
                        extended device statistics
device       r/s     w/s     kr/s     kw/s  ms/r  ms/w  ms/o  ms/t qlen  %b
nda0           0       5      0.7     34.5     0     0     0     0    0   0
pass0          0       0      0.0      0.0     0     0     0     0    0   0

As you can see above, 34.5 while before upgrading, it was around 52.

Gertjan

@all

#metoo, why wait if I can click on Upgrade right now ?
Don't.
Before hitting Upgrade, take 2 minutes to prepare :
A backup of the config file,
I've the ZFS file system, So I created a "23.09" Boot Environments - and booted into it.
Step 2 eliminates step 3 : before every major system upgrade, reboot your pfSense first, and while doing so, look at the console output. Even if its all "chinese" for you.

When done - and as promised, you're 2 minutes later : hit de Upgrade button.

For people that like to have some assurance : check if you have than ISO ready on USB drive, so you can go back whatever happened.
Further more : consider yourself not ready to upgrade if you've found anything that you didn't understand while reading - all - these :

If you like to know more - go here.

Edit : for me it's 23.09 since last Monday.
Even my VPN remote access works fine.

I've checked all the logs files since, and found just this one :

I'm using a Netgate 4100 :

SteveITS

@mcury said in To do 23.09 or not? That's the question.:

If you run zpool scrub pfSense, it will say that: Some supported and requested features are not enabled on the pool.

Is this the pool upgrade note as mentioned in the release notes, under "danger"? :)

Phizix

I think I am going to hold off for about a month on my SG-5100 cause if it ain't broke don't fix it.

mcury

@SteveITS said in To do 23.09 or not? That's the question.:

@mcury said in To do 23.09 or not? That's the question.:

If you run zpool scrub pfSense, it will say that: Some supported and requested features are not enabled on the pool.

Is this the pool upgrade note as mentioned in the release notes, under "danger"? :)

Thanks SteveITS, somehow I missed that 23.05.1 - New Features and Changes info.

tman222

Upgraded two machines from 23.05.1 to 23.09 earlier this week - both finished the upgrade easily in under 5 minutes. No issues to report so far. Enabled the Kea DCHP server - looks to be working great. Logs for it seem a bit more chatty (verbose) though than the prior DHCP server. Also saw the new Intel Speed Shift settings on one of the machines and enabled / configured those as well - working fine so far. Thank you to the whole Netgate team for another great release!

Phizix

Sometime earlier this year or late last year I reloaded from scratch to use ZFS on my SG-5100. Updating to 23.05.1 went without a hitch.

I may still wait. Anyone run their SG-5100 through the update?

Also, I currently only run IPV4 on my internal network and use NAT. Any upgrade issues on that front?

Phizix

johnpoz

Pulled trigger on update few minutes ago.. Looks like it took about a total of 16 minutes from time hit confirm on update to having internet again on my sg4860

I have not checked out every package or services, etc. But pfsense has rebooted and up and showing 23.09 - and my vpn client connected, my HE tunnel shows connected and looks like all my services are running from the service widget page..

Haven't checked yet if tailscale, my openvpn server, etc. is all running... But sure looks like a very successful update, which from my experience is the norm with pfsense..

I didn't bother uninstalling any packages.. I made sure had image from tac for 23.09, I took backup configs, and connected via serial to watch the upgrade in realtime, etc..

Big thumbs up from me.. I will report back after I have chance to make sure freerad, openvpn, tailscale, haproxy, etc are all up and running.. etc..

edit: so freerad clearly working because my phone was able to auth to the wifi with eap-tls, it also was able to connect to openvpn server via cell connection and could ping device on my network. And haproxy is working.. Tailscale shows status of online in pfsense and connected from my phone on cell and able to ping device on my network.. So far sure looks a very successful and clean update..

Checked my throughput to internet, and fine 500/50 without any issues. Which is my plan from my isp.

chudak

Finally came home and also upgraded to 23.09.
Took me a little longer ~30 min as I had to do a hard reboot after ~20 min as the resolver did not seem to work well.
But after that all seemed OK, checked WG, OpenVPN, and TaleScale.

No obvious errors so far. CPU temperature looks a bit higher, but that may be related to the upgrade itself.

I did remove Data Encryption Algorithms that were mentioned as incompatible in the release notes prior to upgrading.
I have now left these:

Gertjan

@chudak said in To do 23.09 or not? That's the question.:

I have now left these:

Remember to export (and import) new client opvn file(s).

@chudak said in To do 23.09 or not? That's the question.:

as the resolver did not seem to work well.

Any details (from the logs) available why it didn't restart ?
It was marked as stopped in the GUI , Restating from the GUI wasn't possible ?

Phizix

Pulled the trigger after getting an image from TAC in case of an issue.

Seems to have gone fine. Memory usage up quite a bit, but I will check after it finishes configuring.

UPDATE: Memory usage is coming down but not yet down to 23.05.1 levels.

Phizix

AndyRH

Finally got around to it, my users are mean when the internet goes down...

No issues on my 7100, as others have said memory usage dropped, mine went from 18% of 8119 MB to 9% of 8120. Not sure how I DLed an extra MB.

CPU usage also dropped from 15% to 6%, but there could have been something going on...

coxhaus

@AndyRH
I upgraded to 23.09. My Cisco L3 switch is working fine. I plan on changing to the next CE version as I am running it at home.

I noticed my Power savings came up Speed shift for my Intel i3-6100T. It also had package level control set. How do I know whether I want package level control set or core level control set? Should I change it to core level control which is recommended?

SteveITS

DHCP issue that can affect some clients, or at least extra logging for others:
https://forum.netgate.com/topic/184104/dhcp-weirdness-after-23-09-upgrade/

Also there is a System Patches release for 23.09 now.

coxhaus

@SteveITS
The nice thing about using a L3 switch is DHCP is in the switch not Pfsense so I have no issues with DHCP.