Messages

We setup the OPNsense fw 21.x  - 21.7.8 - with a policy based site-to-site IPSec VPN tunnel with the latest IKEv2 and mid-level security parameters. Everything on the vpn tunnel, static routing, filtering policies have been operational for several months now.

Our problem:
We noticed that if we review the GUI IPSec VPN configuration (Phase I and/or Phase II) this causes the tunnel to fail several hours later without warning. If we reboot the fw the VPN tunnel recovers but reviewing the IPSec VPN configuration again. Same issue - the tunnel later fails. We noticed that if we review the IPSec VPN tunnel configuration on a Friday the tunnel fails sometime on Friday and on Monday morning it is still in a failed state. We sort of assumed after several days it would recover on its own but it did not. Rebooting reactivated the tunnel.

NOTE: If we don't review the IPSec VPN tunnel configuration the tunnel remains up without issues.

We have been applying the OS updates hoping the bug we are experiencing would be corrected but so far the issue persists and we are currently running OS ver 21.7.8.

The fw log reports it was ignoring an in process request due to already processing, then the fw closed and deleted child SA/SPI which left the session in a half open in hung state. Remote side continues to query. A reboot clears the failed session. The remote side is a Fortigate fw that has many other IPSec VPN tunnels without issues.

We have tried to use the GUI VCR buttons (green arrow and gray square) to reset the vpn tunnel but this only causes the fw to later reboot on its own.

Wondering it we could restart some process other than rebooting the entire fw. We plan on upgrading to OS 22 but were hoping to get a fix before then. I know someone would like to see our configuration but I doubt I can provide this for obvious reasons but perhaps I can provide sections of the config.
Thank you Frank

 
I think this is on the right track - It appears OPNsense.org is self-managing a publicly accessible database the firewall is referencing to determine what security issues exist on itself. - Right?

Is there a web site that shows known OPNsense security vulnerabilities?

Thank you
Frank

THANK YOU

Upgrading OPNsense is simple and easy but once the upgrade has completed, if you discover an issue with the upgrade, Is there a method to revert back to the previous OS version?

Thanks

 
Great, Thank you
 
......... man I wish I knew how to code and ...... yea more time to code. LOL
 
Thanks
Frank

 
Found it!
 
Once I installed the OS-frr plugin, Routing, Diagnostics, General submenu shows the IPv4 Routing Table with a Time column. This Time column indicates the age of the routes in the table. Longer times usually means route stability while shorter times may indicate route instability (E.G. failure). Keep in mind this is not a dynamic screen so -you the user- must keep refreshing the screen to see the latest numbers.

Thanks
Frank

 
Wondering if there is a different (better) GUI interface for OPNsense (latest OS). I'm currently using the web based GUI as it's the only interface I am aware of.
Thank you
Frank

 
moved this message to Production Series as I cannot delete this message.

 
I'll assume you are using the virtual OPNsense and based on that assumption, you add additional interfaces in the host system first - VMware ESXi, VMware Workstation Pro, Oracle Virtulabox, etc. and assign it to a LAN segment.
If you are using a physical box, ignore the remainded of my message. :)

Next step, within OPNsense, go to Interfaces, Assignments tab. If OPNsense detects a new interface, you can assign it there. If OPNsense doesn't see it, go to the command line, you may have to go to the command line as user root and associate the new virtual interface with a em#. then back into Interfaces, Assignments tab.

SIDE NOTE:
I just added a new interface using VMware Workstation 14 Pro and he new interface did not show up within OPNsense GUI so I'd say you have to use the CLI as user root and associate the new virtual interface with an EM# first.

Hoppe this helps
Frank

[?]

 
Not sure what you mean by the grid but I think you saying this is the normal mode of operation and folks that use OPNsense in their production network just accept and live with it?

Thank you
Frank

 
I downloaded, installed and configured the os-frr plugin for dynamic routing for BGP -- OPNsense 21.1.9_1. Testing and evaluating in an isolated test lab.

I notice every little change within OPNsense causes BGP to reset which forces a BGP reinitialization. BGP resetting of course brings the network down. Example, changing the Routing logging level, or adding or removing a prefix filter, etc., causes BGP to reset. How do others work with this vendor's product? Is there a fix to these issues other than don't make changes. LOL

Thanks
Frank

 
My Question: Is there a way to show the date and time routes?
 
I usually judge the stability of the network (other vendors) by how old or new my routes are.

Thank you
Frank

Never mind, I found it ....Routing, BGP, General Tab, .... click on the very tiny advanced mode button.

Thanks
Frank

[Anyone know how to change the BGP Router-ID]

 
I configured OPNsense FW with the complete configuration, interfaces, admins, rules, NAT, IPSec and BGP ....verified operational and then cloned it. Now both boxes had the sane BGP Router-ID and I cannot find the settings to change it.
 
Anyone know how to change the BGP Router-ID?
 
Thank you
Frank