Messages

Hi,

on the console of the master OPNsense with 26.1.9 I get:

pfr_update_stats: assertion failed.

Every 10 minutes.

Any idea where I can get more informations?

Hi,

If I change the advbase on the master (from 1 to 2) and sync the configuration to the slave,
the interfae on the slave looses CARP.

If I reboot the slave, the interface has CARP with the new advbase.

opnsense 26.1.8_5

Strange that it does not happen always, only sometimes.

I solved the problem now by putting the slave bce3 interface on an other switch.

But how can I see/show the 00:00:5E address on the opnsense?

ifconfig doesn't show it.

Btw. switching master in maintenance and back works correct.

How can I see which OPNsense owns the 00:00:5E mac address?

Hm ...

as written: the DUP! happens only when I ping from a server which is in the same net:

Code Select Expand

64 bytes from 192.168.254.248: icmp_seq=537 ttl=64 time=0,400 ms
64 bytes from 192.168.254.248: icmp_seq=538 ttl=64 time=0,338 ms
64 bytes from 192.168.254.248: icmp_seq=539 ttl=64 time=0,286 ms
64 bytes from 192.168.254.248: icmp_seq=540 ttl=64 time=0,202 ms
64 bytes from 192.168.254.248: icmp_seq=541 ttl=64 time=0,261 ms
64 bytes from 192.168.254.248: icmp_seq=541 ttl=64 time=0,350 ms (DUP!)
64 bytes from 192.168.254.248: icmp_seq=542 ttl=64 time=0,275 ms
64 bytes from 192.168.254.248: icmp_seq=542 ttl=64 time=0,328 ms (DUP!)
64 bytes from 192.168.254.248: icmp_seq=543 ttl=64 time=0,389 ms
64 bytes from 192.168.254.248: icmp_seq=544 ttl=64 time=0,421 ms
64 bytes from 192.168.254.248: icmp_seq=544 ttl=64 time=0,477 ms (DUP!)
64 bytes from 192.168.254.248: icmp_seq=545 ttl=64 time=0,305 ms
64 bytes from 192.168.254.248: icmp_seq=546 ttl=64 time=0,319 ms
64 bytes from 192.168.254.248: icmp_seq=547 ttl=64 time=0,395 ms
64 bytes from 192.168.254.248: icmp_seq=548 ttl=64 time=0,319 ms
64 bytes from 192.168.254.248: icmp_seq=548 ttl=64 time=0,373 ms (DUP!)
64 bytes from 192.168.254.248: icmp_seq=549 ttl=64 time=0,267 ms
64 bytes from 192.168.254.248: icmp_seq=550 ttl=64 time=0,336 ms

So it happens not for every ping.

If I ping 248 from my local PC which is not in the same net, it works correct, no DUPs


Master:

Code Select Expand

ifconfig bce3
bce3: flags=1008943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
        description: MANAGEMENT (opt1)
        options=80028<VLAN_MTU,JUMBO_MTU,LINKSTATE>
        ether 1c:c1:de:06:46:a2
        inet 192.168.254.252 netmask 0xfffffc00 broadcast 192.168.255.255
        inet 192.168.254.248 netmask 0xfffffc00 broadcast 192.168.255.255 vhid 16
        groups: CARP_Group
        carp: MASTER vhid 16 advbase 1 advskew 0
              peer 224.0.0.18 peer6 ff02::12
        media: Ethernet autoselect (1000baseT <full-duplex>)
        status: active
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>

Slave:

Code Select Expand

ifconfig bce3
bce3: flags=1008943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
        description: MANAGEMENT (opt1)
        options=80028<VLAN_MTU,JUMBO_MTU,LINKSTATE>
        ether 1c:c1:de:06:38:42
        inet 192.168.254.253 netmask 0xfffffc00 broadcast 192.168.255.255
        inet 192.168.254.248 netmask 0xfffffc00 broadcast 192.168.255.255 vhid 16
        groups: CARP_Group
        carp: BACKUP vhid 16 advbase 1 advskew 100
              peer 224.0.0.18 peer6 ff02::12
        media: Ethernet autoselect (1000baseT <full-duplex>)
        status: active
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>


This interface is on a dedicated 1GB port. No other stuff (VLANs) are involved.

Both opnsense are connected to the same (none stacked) switch.
As already written: clearing the mac address cache changed nothing.

It is very strange.
Even if the packet receives the slave, since the interface tells us 'backup', why is it sending a reply?

We have several interfaces in CARP.
If we ping the VIP address from one of them (no VLAN)
I get sporadic a DUP! and I can see that the slave, which is in backup mode, get the request and replies.
Not on every request, only sometimes.
We already cleared the arp cache of the involved switches.

As you can see, both opnsense send a reply:

Code Select Expand

17:19:32.363137 1c:c1:de:06:46:a2 > a4:bf:01:16:b1:db, ethertype IPv4 (0x0800), length 98: 192.168.254.248 > 192.168.254.167: ICMP echo reply, id 3595
64
17:19:32.363335 1c:c1:de:06:38:42 > a4:bf:01:16:b1:db, ethertype IPv4 (0x0800), length 98: 192.168.254.248 > 192.168.254.167: ICMP echo reply, id 3595
64

But this happens only on the interface without VLAN and on an other interface.
And only when we ping from a server which has also an interface in the same network.

In dmesg I can not see any change of the CARP mode, so it is not 'flipping'.

We are running out of ideas.

Any other idea?

A second try was working without problems.

Hi,

I succesfully updated Slave and Master (CARP) opnsense to 26.1.6
After this I did some changes on the Master and tried to do a HA sync.
Suddenly I got an e-mail from monit of the Slave: CARP status changed
Master was no longer accesible via web GUI. With iLO I came to the console, but no prompt.
I was only able to send a CTRL+ALT+DEL and it started to reboot.

Now it stucks after >>> Invoking backup script 'netflow'

Ok, after a long time it went to the next step and comes up.
But ... a problem with CARP is detected and Master stays on backup.

I had to enter and leave maintenance mode to bring things back to normal.

Can someone confirm such a behaviour?

Hi,

I have an OPNsense connected to the internet and want to get certs via the acme client for an other OPNsense which is behind.
How is this possible?
There is no available automatisation for this.

In a master slave environment on old HP Server hardware I see the following:

Slave:
During the update a warning window appeard: something went wrong, please check the log files.
But the update was completed and the Server rebooted at the end.

Master:
The same warning window appeared and when the reboot should happen it jumped back to the dashboard,
without a reboot.
When I againg clicked on check for updates the window 'reboot is active' appeared, but no reboot was in progress.
I pressed ctrl+alt+del for a reboot.
It took long for shut down, but rebootet succesfully.

I just heard from a colleague that he saw also the warning window but the update worked. (like on our slave)

Only for information.

P.S.: at the moment I see 'pfr_update_stats: assertion failed.' on the master console

System is up and running again with original configuration!

Thank you Franco for your help.

But I think a wait an additional week, before I update the Master.
Maybe you will find something to prevent this behaviour.


Btw. I don't think that the before mentioned segmentation fault is comming from a RAM error.
The system is a HP Server DL360 with ECC RAM and the iLO Management of the Server shows no RAM error.
Also the tests at start are Ok.

As written: the log is not the last log, but was the output of opnsense-update -g

Code Select Expand

pkg install opnsense
Was Ok.

First run of

Code Select Expand

pkg upgrade
results in a segmentation fault.

A second try is now running. ( [99/104] Extracting ruby-3.3.9.1)

Can I run

Code Select Expand

opnsense-bootstrap.sh.in -r 25.7
Without loosing my (maybe) still available configuration of the interfaces and so on?

Hm...

when I run

Code Select Expand

opnsense-update -gI get a log from the update before.
I attached it.