Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Fw1 causes fw2 to reboot when syncing

    General pfSense Questions
    3
    9
    722
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      johns last edited by

      I have two firewalls, fw1 (2.2.2) and fw2 (2.2.2 & 2.2.4).  Whenever I enabled ha sync on fw1, fw2 does a dump and then is stuck in a reboot loop (I've submitted the crash report).  First I thought there was a hardware/software issue on fw2, so I re-installed 2.2.4, but the issue continued, so then I did a fresh install of 2.2.4, but the issue remained.  Then thinking the difference in versions could be adding to the issue, I did a fresh install of both fw1 and fw2 (and used individual backup files (not the full config) and only restored aliases, firewall rules, etc….everything else I configured manually.

      Everything was working great, for a couple hours until I realized I forget to restore/add my traffic limiters, so I started to manually add the limiters...I had only added a couple and applied it to a rule, and the same thing happened, received a dump screen, then went into an endless reboot loop.

      Anyone else see this, or did I find a bug in the limiters?  (I've submitted a number of crash reports)

      Thanks,

      1 Reply Last reply Reply Quote 0
      • J
        johns last edited by

        Also, I've replaced the hardware on both fw1 and fw2 thinking there may have been hw issues, but to no avail, I get the same results on completely different hardware.

        1 Reply Last reply Reply Quote 0
        • Derelict
          Derelict LAYER 8 Netgate last edited by

          Yeah.  Limiters are completely broken on 2.2.  pfSync crashes, adding NAT or proxies disables limiters, etc.

          Unfortunately, it looks like they've punted the fix to 2.3.  I'm still on 2.1.5 where limiters are required.

          I believe the pfSync bug is here:

          https://redmine.pfsense.org/issues/4310

          1 Reply Last reply Reply Quote 0
          • J
            johns last edited by

            Ok, thanks.  So what's the work around, either 1) don't use limiters when using HA, or 2) don't use HA when using limiters?

            1 Reply Last reply Reply Quote 0
            • Derelict
              Derelict LAYER 8 Netgate last edited by

              Don't use 2.2 if you require limiters.

              1 Reply Last reply Reply Quote 0
              • J
                johns last edited by

                Ok, thanks.

                1 Reply Last reply Reply Quote 0
                • C
                  cmb last edited by

                  Limiters are not completely broken on 2.2.x, but there are caveats on interfaces where NAT is applied (usually just WANs) they'll break traffic, and in combination with pfsync they'll crash or hang the secondary. Some of the related issues have been at least improved some, but it's a difficult underlying OS issue.

                  1 Reply Last reply Reply Quote 0
                  • J
                    johns last edited by

                    I'm not using NAT and have it completely disabled, but yet this reboot issue persist.

                    1 Reply Last reply Reply Quote 0
                    • C
                      cmb last edited by

                      This issue is separate from the NAT one. For that case you'd have to disable pfsync to stop that.

                      1 Reply Last reply Reply Quote 0
                      • First post
                        Last post

                      Products

                      • Platform Overview
                      • TNSR
                      • pfSense
                      • Appliances

                      Services

                      • Training
                      • Professional Services

                      Support

                      • Subscription Plans
                      • Contact Support
                      • Product Lifecycle
                      • Documentation

                      News

                      • Media Coverage
                      • Press
                      • Events

                      Resources

                      • Blog
                      • FAQ
                      • Find a Partner
                      • Resource Library
                      • Security Information

                      Company

                      • About Us
                      • Careers
                      • Partners
                      • Contact Us
                      • Legal
                      Our Mission

                      We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

                      Subscribe to our Newsletter

                      Product information, software announcements, and special offers. See our newsletter archive to sign up for future newsletters and to read past announcements.

                      © 2021 Rubicon Communications, LLC | Privacy Policy