WAN disruptions with 802.1X Authentication Bridging

bplein

I am using 802.1X Authentication Bridging in order to get my pfSense (Netgate 4200) directly connected to AT&T. It's been working fine for 2 years.

The other day my internet went down, I rebooted my router and when everything came back up, I started experiencing drops (1-2 seconds where I cannot ping anything outside my side of the router). These occur on a regular 40 second interval.

There are no logs in pfSense that correlate to this issue.

I did see what seems to be a flicker on the port that connects the AT&T RG (the bypassed RG) at the same time as the drops. When I remove the RG, the problem goes away (but I cannot leave it like that because it needs to re-authenicate me after a router reboot or any other timer it might have).

I saw this on 25.x and now on 26.03 with no change in symptoms.

Thoughts?

stephenw10

Can you run a pcap on that port to see what the flicker of traffic might be?

I can only imagine a routing conflict or mac change causing a complete failure like that.

bplein

@stephenw10 Routing can’t be a thing as this is all Ethernet layer traffic for this bypass.

But a pcap makes sense as a first step. It’s going to be a week before I can get to it.

bplein

@stephenw10 A MAC conflict is what it feels like. This setup requires the pfSense appliance to spoof the MAC of the RG. But the rules are set up to only send specific Ethernet packets out the “MODEM” (RG) interface.

It may be a coincidence but my pfSense appliance was showing an available upgrade for a week or so but I was avoiding taking it until I could coordinate with the wife. Then the day I started having issues, I go to the appliance and the purple light which indicates an upgrade is available was back to blue. I was getting concerned that maybe Netgate had a way to force upgrade me. Before I could look into it, I was working from home and struggling with zoom interruptions.

stephenw10

Hmm, 26.03 is the current version. I wouldn't expect it to show an upgrade available from there. Upgrades should never happen automatically. The user must login and initiate it.