WEIRD ping behavior on pfsense 2.1.3 - ESXi 5.5u1



  • Dear All,

    I've got a weird issue with my pfSense VM (ESXi 5.5U1 host) :

    I followed pfsense documentation article about installing pfsense on ESXi.

    I've 3 NIC (lan, static IP wan, dmz). and at the beginning all seems to me working right (good throughput speed, NAT, Openvpn etc).

    But I discovered that when I try to ping WAN GW from web interface or even from shell ping packets start with a huge delay.

    Same behavior trying to ping anything from the fw vm (Lan IP, External IP, DNS IP, 8.8.8.8

    Other icmp type (traceroute) works with no delay at all.

    Echo Request & Echo Reply from WAN IP GW go and come with right timing and delay, but every ping request start with a delay :

    eg :

    ping WAN_GW_IP
    PING WAN_GW_IP (WAN_GW_IP): 56 data bytes
    64 bytes from WAN_GW_IP: icmp_seq=0 ttl=64 time=5.373 ms

    then it hangs for about 4 to 5 seconds then :

    64 bytes from WAN_GW_IP: icmp_seq=1 ttl=64 time=4.083 ms

    other 5 seconds then :

    64 bytes from WAN_GW_IP: icmp_seq=2 ttl=64 time=4.083 ms

    and so on . . .

    As side effect : obviously APINGER don't work correctly, I had to stop GATEWAY MONITORING, for a lot of reload requests (VPN, FW RULES etc . . ).

    I've noticed that ping seems to work correctly when I reload FW rules (it works for the time rules being loaded, then stop working correctly again).

    Already tried to tcpdump icmp request and all seems ok.

    UPDATE : tcpdump run from nternal lan host (10.10.0.15) while pinging from pfsense lan gw ip (10.10.0.254) :

    tcpdump -ni eth0 icmp and host 10.10.0.254
    tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
    listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes

    15:13:28.902147 IP 10.10.0.254 > 10.10.0.15: ICMP echo request, id 31327, seq 0, length 64
    15:13:28.902214 IP 10.10.0.15 > 10.10.0.254: ICMP echo reply, id 31327, seq 0, length 64

    15:13:45.114724 IP 10.10.0.254 > 10.10.0.15: ICMP echo request, id 31327, seq 1, length 64
    15:13:45.114790 IP 10.10.0.15 > 10.10.0.254: ICMP echo reply, id 31327, seq 1, length 64

    15:14:02.308370 IP 10.10.0.254 > 10.10.0.15: ICMP echo request, id 31327, seq 2, length 64
    15:14:02.308423 IP 10.10.0.15 > 10.10.0.254: ICMP echo reply, id 31327, seq 2, length 64
    15:14:23.864931 IP 10.10.0.254 > 10.10.0.15: ICMP echo request, id 31327, seq 3, length 64
    15:14:23.864999 IP 10.10.0.15 > 10.10.0.254: ICMP echo reply, id 31327, seq 3, length 64
    15:14:52.628042 IP 10.10.0.254 > 10.10.0.15: ICMP echo request, id 31327, seq 4, length 64
    15:14:52.628109 IP 10.10.0.15 > 10.10.0.254: ICMP echo reply, id 31327, seq 4, length 64
    15:15:02.679425 IP 10.10.0.254 > 10.10.0.15: ICMP host 173.194.35.48 unreachable, length 36
    15:15:08.866422 IP 10.10.0.254 > 10.10.0.15: ICMP echo request, id 31327, seq 5, length 64
    15:15:08.866488 IP 10.10.0.15 > 10.10.0.254: ICMP echo reply, id 31327, seq 5, length 64
    15:15:14.365213 IP 10.10.0.254 > 10.10.0.15: ICMP echo request, id 31327, seq 6, length 64
    15:15:14.365261 IP 10.10.0.15 > 10.10.0.254: ICMP echo reply, id 31327, seq 6, length 64
    15:15:35.941256 IP 10.10.0.254 > 10.10.0.15: ICMP echo request, id 31327, seq 7, length 64
    15:15:35.941307 IP 10.10.0.15 > 10.10.0.254: ICMP echo reply, id 31327, seq 7, length 64
    15:16:02.532726 IP 10.10.0.254 > 10.10.0.15: ICMP echo request, id 31327, seq 8, length 64
    15:16:02.532782 IP 10.10.0.15 > 10.10.0.254: ICMP echo reply, id 31327, seq 8, length 64
    15:16:17.911306 IP 10.10.0.254 > 10.10.0.15: ICMP echo request, id 31327, seq 9, length 64
    15:16:17.911371 IP 10.10.0.15 > 10.10.0.254: ICMP echo reply, id 31327, seq 9, length 64
    15:16:42.425018 IP 10.10.0.254 > 10.10.0.15: ICMP echo request, id 31327, seq 10, length 64
    15:16:42.425073 IP 10.10.0.15 > 10.10.0.254: ICMP echo reply, id 31327, seq 10, length 64

    look at tcpdump timestamp. Lan client respond quickly, but huge interval from one echo request and another echo request.

    weird.

    Any ideas ?

    Thanking in advance,

    Finest regards

    Paolo


Log in to reply