Topics

Moin zusammen!

Folgendes Szenario:

Im Datacenter:

OPNsense 19.7.2-amd64
FreeBSD 11.2-RELEASE-p12-HBSD
OpenSSL 1.0.2s 28 May 2019

Zu Hause:

OPNsense 19.7.3-amd64
FreeBSD 11.2-RELEASE-p14-HBSD
OpenSSL 1.0.2s 28 May 2019

IPSEC:

Im DataCenter folgende Konfiguration:



Zu Hause folgende Konfiguration:


Nun folgendes Problem:

Logs vom Datacenter:

Code Select Expand

Sep 2 20:27:40 charon: 05[IKE] <con2|4> received AUTHENTICATION_FAILED notify error
Sep 2 20:27:40 charon: 05[ENC] <con2|4> parsed IKE_AUTH response 1 [ N(AUTH_FAILED) ]
Sep 2 20:27:40 charon: 05[NET] <con2|4> received packet: from 80.XXX.XXX.55[4500] to 149.XXX.XXX.178.178[4500] (80 bytes)
Sep 2 20:27:40 charon: 05[NET] <con2|4> sending packet: from 149.XXX.XXX.178.178[4500] to 80.XXX.XXX.55[4500] (116 bytes)
Sep 2 20:27:40 charon: 05[NET] <con2|4> sending packet: from 149.XXX.XXX.178.178[4500] to 80.XXX.XXX.55[4500] (1236 bytes)
Sep 2 20:27:40 charon: 05[NET] <con2|4> sending packet: from 149.XXX.XXX.178.178[4500] to 80.XXX.XXX.55[4500] (1236 bytes)
Sep 2 20:27:40 charon: 05[ENC] <con2|4> generating IKE_AUTH request 1 [ EF(3/3) ]
Sep 2 20:27:40 charon: 05[ENC] <con2|4> generating IKE_AUTH request 1 [ EF(2/3) ]
Sep 2 20:27:40 charon: 05[ENC] <con2|4> generating IKE_AUTH request 1 [ EF(1/3) ]
Sep 2 20:27:40 charon: 05[ENC] <con2|4> splitting IKE message (2448 bytes) into 3 fragments
Sep 2 20:27:40 charon: 05[ENC] <con2|4> generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ IDr AUTH N(ESP_TFC_PAD_N) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_6_ADDR) N(ADD_6_ADDR) N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
Sep 2 20:27:40 charon: 05[IKE] <con2|4> establishing CHILD_SA con2{11}
Sep 2 20:27:40 charon: 05[IKE] <con2|4> authentication of '149.XXX.XXX.178.178' (myself) with pre-shared key
Sep 2 20:27:40 charon: 05[IKE] <con2|4> sending cert request for "C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3"
Sep 2 20:27:40 charon: 05[IKE] <con2|4> sending cert request for "C=DE, ST=Niedersachsen, L=Nottensdorf, O=SJT CONSULTING, E=info@example.de, CN=internal-ca"
Sep 2 20:27:40 charon: 05[CFG] <con2|4> selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
Sep 2 20:27:40 charon: 05[ENC] <con2|4> parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(CHDLESS_SUP) N(MULT_AUTH) ]
Sep 2 20:27:40 charon: 05[NET] <con2|4> received packet: from 80.XXX.XXX.55[500] to 149.XXX.XXX.178.178[500] (472 bytes)
Sep 2 20:27:40 charon: 05[NET] <con2|4> sending packet: from 149.XXX.XXX.178.178[500] to 80.XXX.XXX.55[500] (464 bytes)
Sep 2 20:27:40 charon: 05[ENC] <con2|4> generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Sep 2 20:27:40 charon: 05[IKE] <con2|4> initiating IKE_SA con2[4] to 80.XXX.XXX.55
Sep 2 20:27:40 charon: 10[CFG] received stroke: initiate 'con2'

Logs von zu Hause:

Code Select Expand

Sep 2 20:27:40 charon: 14[NET] <3> sending packet: from 80.XXX.XXX.55[4500] to 149.XXX.XXX.178[4500] (80 bytes)
Sep 2 20:27:40 charon: 14[ENC] <3> generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]
Sep 2 20:27:40 charon: 14[IKE] <3> peer supports MOBIKE
Sep 2 20:27:40 charon: 14[IKE] <3> received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding
Sep 2 20:27:40 charon: 14[CFG] <3> no matching peer config found
Sep 2 20:27:40 charon: 14[CFG] <3> looking for peer configs matching 80.XXX.XXX.55[91.248.236.17]...149.XXX.XXX.178[149.XXX.XXX.178]
Sep 2 20:27:40 charon: 14[IKE] <3> received 2 cert requests for an unknown ca
Sep 2 20:27:40 charon: 14[ENC] <3> parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ IDr AUTH N(ESP_TFC_PAD_N) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_6_ADDR) N(ADD_6_ADDR) N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
Sep 2 20:27:40 charon: 14[ENC] <3> received fragment #2 of 3, reassembled fragmented IKE message (2448 bytes)
Sep 2 20:27:40 charon: 14[ENC] <3> parsed IKE_AUTH request 1 [ EF(2/3) ]
Sep 2 20:27:40 charon: 14[NET] <3> received packet: from 149.XXX.XXX.178[4500] to 80.XXX.XXX.55[4500] (1236 bytes)
Sep 2 20:27:40 charon: 15[ENC] <3> received fragment #3 of 3, waiting for complete IKE message
Sep 2 20:27:40 charon: 15[ENC] <3> parsed IKE_AUTH request 1 [ EF(3/3) ]
Sep 2 20:27:40 charon: 15[NET] <3> received packet: from 149.XXX.XXX.178[4500] to 80.XXX.XXX.55[4500] (116 bytes)
Sep 2 20:27:40 charon: 08[ENC] <3> received fragment #1 of 3, waiting for complete IKE message
Sep 2 20:27:40 charon: 08[ENC] <3> parsed IKE_AUTH request 1 [ EF(1/3) ]
Sep 2 20:27:40 charon: 08[NET] <3> received packet: from 149.XXX.XXX.178[4500] to 80.XXX.XXX.55[4500] (1236 bytes)
Sep 2 20:27:40 charon: 14[NET] <3> sending packet: from 80.XXX.XXX.55[500] to 149.XXX.XXX.178[500] (472 bytes)
Sep 2 20:27:40 charon: 14[ENC] <3> generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(CHDLESS_SUP) N(MULT_AUTH) ]
Sep 2 20:27:40 charon: 14[CFG] <3> selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
Sep 2 20:27:40 charon: 14[IKE] <3> 149.XXX.XXX.178 is initiating an IKE_SA
Sep 2 20:27:40 charon: 14[ENC] <3> parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Sep 2 20:27:40 charon: 14[NET] <3> received packet: from 149.XXX.XXX.178[500] to 80.XXX.XXX.55[500] (464 bytes)


Einer ne Idee warum der hier irgendwie was mit Zerts machen will? Soll er nicht!

Moin zusammen!

System:

OPNsense 19.7.2-amd64
FreeBSD 11.2-RELEASE-p12-HBSD
OpenSSL 1.0.2s 28 May 2019

System beim Kunden:

Cisco ASA 5520

Ich habe folgendes Problem: ipsec ist eingerichtet

Code Select Expand

root@DEHAM01-FW01:# ipsec status
no files found matching '/usr/local/etc/strongswan.opnsense.d/*.conf'
Routed Connections:
    con1-009{39}:  CREATED, TUNNEL, reqid 29
    con1-009{39}:   172.21.106.0/24 === 10.164.141.10/32
    con1-008{38}:  CREATED, TUNNEL, reqid 28
    con1-008{38}:   172.21.106.0/24 === 10.164.255.17/32
    con1-007{37}:  CREATED, TUNNEL, reqid 27
    con1-007{37}:   172.21.106.0/24 === 10.164.140.34/32
    con1-006{36}:  CREATED, TUNNEL, reqid 26
    con1-006{36}:   172.21.106.0/24 === 172.22.112.0/24
    con1-005{35}:  CREATED, TUNNEL, reqid 25
    con1-005{35}:   172.21.106.0/24 === 172.22.126.0/24
    con1-004{34}:  CREATED, TUNNEL, reqid 24
    con1-004{34}:   172.21.106.0/24 === 172.22.121.0/24
    con1-003{33}:  CREATED, TUNNEL, reqid 23
    con1-003{33}:   172.21.106.0/24 === 10.164.254.160/27
    con1-002{32}:  CREATED, TUNNEL, reqid 22
    con1-002{32}:   172.21.106.0/24 === 10.164.254.128/27
    con1-001{31}:  CREATED, TUNNEL, reqid 21
    con1-001{31}:   172.21.106.0/24 === 10.164.254.64/26
    con1-000{30}:  CREATED, TUNNEL, reqid 2
    con1-000{30}:   172.21.106.0/24 === 10.164.254.32/27
Security Associations (1 up, 0 connecting):
    con1-000[5]: ESTABLISHED 22 seconds ago, 149.XXX.XXX.XXX[149.XXX.XXX.XXX]...194.XXX.XXX.XXX[194.XXX.XXX.XXX]
    con1-000{40}:  INSTALLED, TUNNEL, reqid 2, ESP SPIs: c6f0bf35_i 0678ef9d_o
    con1-000{40}:   172.21.106.0/24 === 10.164.254.32/27
    con1-001{41}:  INSTALLED, TUNNEL, reqid 21, ESP SPIs: ce913538_i 43cf35fc_o
    con1-001{41}:   172.21.106.0/24 === 10.164.254.64/26
    con1-002{42}:  INSTALLED, TUNNEL, reqid 22, ESP SPIs: ca16100e_i dfdf4782_o
    con1-002{42}:   172.21.106.0/24 === 10.164.254.128/27
    con1-003{43}:  INSTALLED, TUNNEL, reqid 23, ESP SPIs: c28ac187_i 00ce068a_o
    con1-003{43}:   172.21.106.0/24 === 10.164.254.160/27
    con1-004{44}:  INSTALLED, TUNNEL, reqid 24, ESP SPIs: cd6d51b0_i 79565116_o
    con1-004{44}:   172.21.106.0/24 === 172.22.121.0/24
    con1-005{45}:  INSTALLED, TUNNEL, reqid 25, ESP SPIs: cf4293ed_i 1171cabd_o
    con1-005{45}:   172.21.106.0/24 === 172.22.126.0/24
    con1-006{46}:  INSTALLED, TUNNEL, reqid 26, ESP SPIs: cdf727dd_i 389b4373_o
    con1-006{46}:   172.21.106.0/24 === 172.22.112.0/24
    con1-007{47}:  INSTALLED, TUNNEL, reqid 27, ESP SPIs: cfb1c13c_i fe8c444f_o
    con1-007{47}:   172.21.106.0/24 === 10.164.140.34/32
    con1-008{48}:  INSTALLED, TUNNEL, reqid 28, ESP SPIs: cf11def8_i 6a75d7b8_o
    con1-008{48}:   172.21.106.0/24 === 10.164.255.17/32
    con1-009{49}:  INSTALLED, TUNNEL, reqid 29, ESP SPIs: c6208dcf_i 9d008adf_o
    con1-009{49}:   172.21.106.0/24 === 10.164.141.10/32


Nur irgendwie geht da nix durch den Tunnel :! Einer eine Idee?


Tunnel gelöscht und neuangelegt dann ging es ...

Moin zusammen,

habe gerade mein Backup-Node aktualisiert auf 19.1.5 und nun krieg ich diese tolle Meldung:

normally uses encryption to protect your information. When Google Chrome tried to connect to deham01-fw02.XXXXX.de this time, the website sent back unusual and incorrect credentials. This may happen when an attacker is trying to pretend to be deham01-fw02.XXXX.de, or a Wi-Fi sign-in screen has interrupted the connection. Your information is still secure because Google Chrome stopped the connection before any data was exchanged.

You cannot visit deham01-fw02.XXXX.de right now because the website uses HSTS. Network errors and attacks are usually temporary, so this page will probably work later.

Das Zertifikat was aktiv ist, ist von opnsense heute ausgestellt worden...

Eine ne Idee wie ich über SSH das richtige Zertifikat wieder laden tue?

Danke!

LG
Sven-Jendrik


// Gelöst, konnte mich mit dem edge einloggen :D

Hi,

I wrote already in the german part of this awesome forum: https://forum.opnsense.org/index.php?topic=11687.0

But maybe someone of you have an Idea:

I got the following message all the time:

CARP has detected a problem and this unit has been demoted to BACKUP status.
Check link status on all interfaces with configured CARP VIPs.

Following Setup: 2x DL360p Gen8 as Firewall OPNsense 19.1 installed

LAGG0 / LACP - bge0 / bge1 for WAN (HP Ethernet 1Gb 4-port 331FLR Adapter)
LAGG1 / LACP - bxe0 / bxe1 for all vlans (10GB) (HP Ethernet 10Gb 2-port 530T Adapter)

LAGG0 with a transfernet works as expected. Everything is fine here:

Switch Bridge Configuration: LAGG0 / LACP / WAN

LAGG0: FW-NODE01
<DEHAM01-CORE-01>display interface Bridge-Aggregation 1
Bridge-Aggregation1
Current state: UP
IP packet frame type: Ethernet II, hardware address: 5c8a-3850-2332
Description: LACP-FW-1-INET
Bandwidth: 2000000 kbps
2Gbps-speed mode, full-duplex mode
Link speed type is autonegotiation, link duplex type is autonegotiation
PVID: 15
Port link-type: Access
Tagged VLANs:   None
Untagged VLANs: 15
Last clearing of counters: Never
Last 300 seconds input:  112 packets/sec 91282 bytes/sec 0%
Last 300 seconds output:  113 packets/sec 88820 bytes/sec 0%
Input (total):  69182321 packets, 15868738090 bytes
        68822555 unicasts, 88195 broadcasts, 271571 multicasts, 0 pauses
Input (normal):  69182321 packets, - bytes
        68822555 unicasts, 88195 broadcasts, 271571 multicasts, 0 pauses
Input:  0 input errors, 0 runts, 0 giants, 0 throttles
        0 CRC, 0 frame, - overruns, 0 aborts
        - ignored, - parity errors
Output (total): 683819046 packets, 988166268219 bytes
        682716902 unicasts, 224279 broadcasts, 877865 multicasts, 0 pauses

LAGG0: FW-NODE02
<DEHAM01-CORE-01>display interface Bridge-Aggregation 3
Bridge-Aggregation3
Current state: UP
IP packet frame type: Ethernet II, hardware address: 5c8a-3850-2334
Description: LACP-FW-2-INET
Bandwidth: 2000000 kbps
2Gbps-speed mode, full-duplex mode
Link speed type is autonegotiation, link duplex type is autonegotiation
PVID: 15
Port link-type: Access
Tagged VLANs:   None
Untagged VLANs: 15
Last clearing of counters: Never
Last 300 seconds input:  1 packets/sec 78 bytes/sec 0%
Last 300 seconds output:  2 packets/sec 232 bytes/sec 0%
Input (total):  1173615 packets, 484490037 bytes
        1051210 unicasts, 87942 broadcasts, 34463 multicasts, 0 pauses
Input (normal):  1173615 packets, - bytes
        1051210 unicasts, 87942 broadcasts, 34463 multicasts, 0 pauses
Input:  0 input errors, 0 runts, 0 giants, 0 throttles
        0 CRC, 0 frame, - overruns, 0 aborts
        - ignored, - parity errors
Output (total): 3160504 packets, 1886456666 bytes
        1821496 unicasts, 224600 broadcasts, 1114408 multicasts, 0 pauses
Output (normal): 3160504 packets, - bytes
        1821496 unicasts, 224600 broadcasts, 1114408 multicasts, 0 pauses
Output: 0 output errors, - underruns, - buffer failures
        0 aborts, 0 deferred, 0 collisions, 0 late collisions
        0 lost carrier, - no carrier

Switch Bridge Configuration: LAGG1 / LACP / VLANS

LAGG1: FW-NODE1
<DEHAM01-CORE-01>display interface Bridge-Aggregation 2
Bridge-Aggregation2
Current state: UP
IP packet frame type: Ethernet II, hardware address: 5c8a-3850-2333
Description: LACP-FW-1-trunk
Bandwidth: 20000000 kbps
20Gbps-speed mode, full-duplex mode
Link speed type is autonegotiation, link duplex type is autonegotiation
PVID: 1
Port link-type: Trunk
VLAN Passing:   1(default vlan), 10, 40, 42-44, 47, 150, 500-506, 547, 551-552, 1000-1003, 1011, 1020, 1150, 4000-4001
VLAN permitted: 1(default vlan), 10, 40-4094
Trunk port encapsulation: IEEE 802.1q
Last clearing of counters: Never
Last 300 seconds input:  23 packets/sec 4297 bytes/sec 0%
Last 300 seconds output:  19 packets/sec 6576 bytes/sec 0%
Input (total):  1305255099 packets, 1730191247711 bytes
        1302081181 unicasts, 7510 broadcasts, 3166408 multicasts, 0 pauses
Input (normal):  1305255099 packets, - bytes
        1302081181 unicasts, 7510 broadcasts, 3166408 multicasts, 0 pauses
Input:  0 input errors, 0 runts, 0 giants, 0 throttles
        0 CRC, 0 frame, - overruns, 0 aborts
        - ignored, - parity errors
Output (total): 690755112 packets, 753149602631 bytes
        688259838 unicasts, 154091 broadcasts, 2341183 multicasts, 0 pauses
Output (normal): 690755112 packets, - bytes
        688259838 unicasts, 154091 broadcasts, 2341183 multicasts, 0 pauses
Output: 0 output errors, - underruns, - buffer failures
        0 aborts, 0 deferred, 0 collisions, 0 late collisions
        0 lost carrier, - no carrier

LAGG1: FW-NODE2
<DEHAM01-CORE-01>display interface Bridge-Aggregation 4
Bridge-Aggregation4
Current state: UP
IP packet frame type: Ethernet II, hardware address: 5c8a-3850-2335
Description: LACP-FW-2-trunk
Bandwidth: 20000000 kbps
20Gbps-speed mode, full-duplex mode
Link speed type is autonegotiation, link duplex type is autonegotiation
PVID: 3
Port link-type: Trunk
VLAN Passing:   3, 10, 40, 42-44, 47, 150, 500-506, 547, 551-552, 1000-1003, 1011, 1020, 1150, 4000-4001
VLAN permitted: 3, 10, 40-4094
Trunk port encapsulation: IEEE 802.1q
Last clearing of counters: Never
Last 300 seconds input:  0 packets/sec 126 bytes/sec 0%
Last 300 seconds output:  12 packets/sec 2172 bytes/sec 0%
Input (total):  2361306 packets, 2234309304 bytes
        1517489 unicasts, 1323 broadcasts, 842494 multicasts, 0 pauses
Input (normal):  2361306 packets, - bytes
        1517489 unicasts, 1323 broadcasts, 842494 multicasts, 0 pauses
Input:  0 input errors, 0 runts, 0 giants, 0 throttles
        0 CRC, 0 frame, - overruns, 0 aborts
        - ignored, - parity errors
Output (total): 5115311 packets, 1190861340 bytes
        776382 unicasts, 141679 broadcasts, 4197250 multicasts, 0 pauses
Output (normal): 5115311 packets, - bytes
        776382 unicasts, 141679 broadcasts, 4197250 multicasts, 0 pauses
Output: 0 output errors, - underruns, - buffer failures
        0 aborts, 0 deferred, 0 collisions, 0 late collisions
        0 lost carrier, - no carrier

TCPDUMP LAGG0: FW-NODE1
root@DEHAM01-FW01:~ # tcpdump -i lagg0 -ttt -n proto CARP
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lagg0, link-type EN10MB (Ethernet), capture size 262144 bytes
00:00:00.000000 IP xxx.xxx.142.179 > 224.0.0.18: VRRPv2, Advertisement, vrid 1, prio 240, authtype none, intvl 1s, length 36
00:00:00.000023 IP xxx.xxx.142.179 > 224.0.0.18: VRRPv2, Advertisement, vrid 1, prio 240, authtype none, intvl 1s, length 36
00:00:02.009931 IP xxx.xxx.142.179 > 224.0.0.18: VRRPv2, Advertisement, vrid 1, prio 240, authtype none, intvl 1s, length 36
00:00:00.000022 IP xxx.xxx.142.179 > 224.0.0.18: VRRPv2, Advertisement, vrid 1, prio 240, authtype none, intvl 1s, length 36

TCPDUMP LAGG0: FW-NODE2
root@DEHAM01-FW02:~ # tcpdump -i lagg0 -ttt -n proto CARP
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lagg0, link-type EN10MB (Ethernet), capture size 262144 bytes
00:00:00.000000 IP xxx.xxx.142.179 > 224.0.0.18: VRRPv2, Advertisement, vrid 1, prio 240, authtype none, intvl 1s, length 36
00:00:02.008065 IP xxx.xxx.142.179 > 224.0.0.18: VRRPv2, Advertisement, vrid 1, prio 240, authtype none, intvl 1s, length 36
00:00:02.011843 IP xxx.xxx.142.179 > 224.0.0.18: VRRPv2, Advertisement, vrid 1, prio 240, authtype none, intvl 1s, length 36

TCPDUMP LAGG1: FW-NODE1
root@DEHAM01-FW01:~ # tcpdump -i lagg1_vlan10 -ttt -n proto CARP
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lagg1_vlan10, link-type EN10MB (Ethernet), capture size 262144 bytes
00:00:00.000000 IP 10.100.10.251 > 224.0.0.18: VRRPv2, Advertisement, vrid 2, prio 240, authtype none, intvl 1s, length 36
00:00:01.941046 IP 10.100.10.251 > 224.0.0.18: VRRPv2, Advertisement, vrid 2, prio 240, authtype none, intvl 1s, length 36
00:00:01.944357 IP 10.100.10.251 > 224.0.0.18: VRRPv2, Advertisement, vrid 2, prio 240, authtype none, intvl 1s, length 36
00:00:02.019615 IP 10.100.10.251 > 224.0.0.18: VRRPv2, Advertisement, vrid 2, prio 240, authtype none, intvl 1s, length 36

TCPDUMP LAGG1: FW-NODE2:
root@DEHAM01-FW02:~ # tcpdump -i lagg1_vlan10 -ttt -n proto CARP
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lagg1_vlan10, link-type EN10MB (Ethernet), capture size 262144 bytes
00:00:00.000000 IP 10.100.10.251 > 224.0.0.18: VRRPv2, Advertisement, vrid 2, prio 240, authtype none, intvl 1s, length 36
00:00:01.942515 IP 10.100.10.251 > 224.0.0.18: VRRPv2, Advertisement, vrid 2, prio 240, authtype none, intvl 1s, length 36
00:00:01.975992 IP 10.100.10.251 > 224.0.0.18: VRRPv2, Advertisement, vrid 2, prio 240, authtype none, intvl 1s, length 36
00:00:01.956651 IP 10.100.10.251 > 224.0.0.18: VRRPv2, Advertisement, vrid 2, prio 240, authtype none, intvl 1s, length 36

Master after reboot:

Master nach einem Reboot:
Feb 18 22:00:50 DEHAM01-FW01 kernel: carp: 2@lagg1_vlan10: MASTER -> BACKUP (more frequent advertisement received)
Feb 18 22:00:50 DEHAM01-FW01 kernel: carp: 4@lagg1_vlan42: MASTER -> BACKUP (more frequent advertisement received)
Feb 18 22:00:50 DEHAM01-FW01 kernel: carp: 6@lagg1_vlan44: MASTER -> BACKUP (more frequent advertisement received)
Feb 18 22:00:50 DEHAM01-FW01 kernel: carp: 3@lagg1_vlan40: MASTER -> BACKUP (more frequent advertisement received)
Feb 18 22:00:50 DEHAM01-FW01 kernel: carp: 5@lagg1_vlan43: MASTER -> BACKUP (more frequent advertisement received)
Feb 18 22:00:50 DEHAM01-FW01 kernel: carp: 7@lagg1_vlan150: MASTER -> BACKUP (more frequent advertisement received)
Feb 18 22:00:50 DEHAM01-FW01 kernel: carp: 10@lagg1_vlan1002: MASTER -> BACKUP (more frequent advertisement received)
Feb 18 22:00:50 DEHAM01-FW01 kernel: carp: 9@lagg1_vlan1001: MASTER -> BACKUP (more frequent advertisement received)
Feb 18 22:00:50 DEHAM01-FW01 kernel: carp: 11@lagg1_vlan1003: MASTER -> BACKUP (more frequent advertisement received)
Feb 18 22:00:50 DEHAM01-FW01 kernel: carp: 8@lagg1_vlan1000: MASTER -> BACKUP (more frequent advertisement received)
Feb 18 22:00:50 DEHAM01-FW01 kernel: carp: 13@lagg1_vlan1020: MASTER -> BACKUP (more frequent advertisement received)
Feb 18 22:00:50 DEHAM01-FW01 kernel: carp: 16@lagg1_vlan4001: MASTER -> BACKUP (more frequent advertisement received)
Feb 18 22:00:50 DEHAM01-FW01 kernel: carp: 15@lagg1_vlan4000: MASTER -> BACKUP (more frequent advertisement received)
Feb 18 22:00:50 DEHAM01-FW01 kernel: carp: 12@lagg1_vlan1011: MASTER -> BACKUP (more frequent advertisement received)
Feb 18 22:00:50 DEHAM01-FW01 kernel: carp: 17@lagg1_vlan47: MASTER -> BACKUP (more frequent advertisement received)
Feb 18 22:00:50 DEHAM01-FW01 kernel: carp: 14@lagg1_vlan1150: MASTER -> BACKUP (more frequent advertisement received)
Feb 18 22:06:28 DEHAM01-FW01 kernel: carp: 1@lagg0: MASTER -> BACKUP (more frequent advertisement received)
Feb 18 22:06:28 DEHAM01-FW01 opnsense: /usr/local/etc/rc.syshook.d/carp/20-openvpn: Carp cluster member "XXXX.142.178 -  (1@lagg0)" has resumed the state "BACKUP" for vhid 1
Feb 18 22:10:01 DEHAM01-FW01 kernel: carp: 1@lagg0: INIT -> BACKUP (initialization complete)
Feb 18 22:10:01 DEHAM01-FW01 kernel: carp: 2@lagg1_vlan10: INIT -> BACKUP (initialization complete)
Feb 18 22:10:01 DEHAM01-FW01 opnsense: /usr/local/etc/rc.syshook.d/carp/20-openvpn: Carp cluster member "XXX.142.178 -  (1@lagg0)" has resumed the state "BACKUP" for vhid 1
Feb 18 22:10:01 DEHAM01-FW01 kernel: carp: 3@lagg1_vlan40: INIT -> BACKUP (initialization complete)
Feb 18 22:10:01 DEHAM01-FW01 kernel: carp: 4@lagg1_vlan42: INIT -> BACKUP (initialization complete)
Feb 18 22:10:01 DEHAM01-FW01 kernel: carp: 5@lagg1_vlan43: INIT -> BACKUP (initialization complete)
Feb 18 22:10:01 DEHAM01-FW01 kernel: carp: 6@lagg1_vlan44: INIT -> BACKUP (initialization complete)
Feb 18 22:10:01 DEHAM01-FW01 kernel: carp: 7@lagg1_vlan150: INIT -> BACKUP (initialization complete)
Feb 18 22:10:01 DEHAM01-FW01 kernel: carp: 8@lagg1_vlan1000: INIT -> BACKUP (initialization complete)
Feb 18 22:10:01 DEHAM01-FW01 kernel: carp: 9@lagg1_vlan1001: INIT -> BACKUP (initialization complete)
Feb 18 22:10:01 DEHAM01-FW01 kernel: carp: 10@lagg1_vlan1002: INIT -> BACKUP (initialization complete)
Feb 18 22:10:01 DEHAM01-FW01 kernel: carp: 11@lagg1_vlan1003: INIT -> BACKUP (initialization complete)
Feb 18 22:10:01 DEHAM01-FW01 kernel: carp: 12@lagg1_vlan1011: INIT -> BACKUP (initialization complete)
Feb 18 22:10:01 DEHAM01-FW01 kernel: carp: 13@lagg1_vlan1020: INIT -> BACKUP (initialization complete)
Feb 18 22:10:01 DEHAM01-FW01 kernel: carp: 14@lagg1_vlan1150: INIT -> BACKUP (initialization complete)
Feb 18 22:10:01 DEHAM01-FW01 kernel: carp: 15@lagg1_vlan4000: INIT -> BACKUP (initialization complete)
Feb 18 22:10:01 DEHAM01-FW01 kernel: carp: 16@lagg1_vlan4001: INIT -> BACKUP (initialization complete)
Feb 18 22:10:01 DEHAM01-FW01 kernel: carp: 17@lagg1_vlan47: INIT -> BACKUP (initialization complete)
Feb 18 22:10:02 DEHAM01-FW01 kernel: carp: demoted by 240 to 240 (pfsync bulk start)
Feb 18 22:10:04 DEHAM01-FW01 kernel: carp: 2@lagg1_vlan10: BACKUP -> MASTER (master timed out)
Feb 18 22:10:04 DEHAM01-FW01 kernel: carp: 3@lagg1_vlan40: BACKUP -> MASTER (master timed out)
Feb 18 22:10:04 DEHAM01-FW01 kernel: carp: 4@lagg1_vlan42: BACKUP -> MASTER (master timed out)
Feb 18 22:10:04 DEHAM01-FW01 kernel: carp: 5@lagg1_vlan43: BACKUP -> MASTER (master timed out)
Feb 18 22:10:04 DEHAM01-FW01 kernel: carp: 6@lagg1_vlan44: BACKUP -> MASTER (master timed out)
Feb 18 22:10:04 DEHAM01-FW01 kernel: carp: 7@lagg1_vlan150: BACKUP -> MASTER (master timed out)
Feb 18 22:10:04 DEHAM01-FW01 kernel: carp: 8@lagg1_vlan1000: BACKUP -> MASTER (master timed out)
Feb 18 22:10:04 DEHAM01-FW01 kernel: carp: 9@lagg1_vlan1001: BACKUP -> MASTER (master timed out)
Feb 18 22:10:04 DEHAM01-FW01 kernel: carp: 10@lagg1_vlan1002: BACKUP -> MASTER (master timed out)
Feb 18 22:10:04 DEHAM01-FW01 kernel: carp: 11@lagg1_vlan1003: BACKUP -> MASTER (master timed out)
Feb 18 22:10:04 DEHAM01-FW01 kernel: carp: 12@lagg1_vlan1011: BACKUP -> MASTER (master timed out)
Feb 18 22:10:04 DEHAM01-FW01 kernel: carp: 13@lagg1_vlan1020: BACKUP -> MASTER (master timed out)
Feb 18 22:10:04 DEHAM01-FW01 kernel: carp: 14@lagg1_vlan1150: BACKUP -> MASTER (master timed out)
Feb 18 22:10:04 DEHAM01-FW01 kernel: carp: 15@lagg1_vlan4000: BACKUP -> MASTER (master timed out)
Feb 18 22:10:05 DEHAM01-FW01 kernel: carp: 16@lagg1_vlan4001: BACKUP -> MASTER (master timed out)
Feb 18 22:10:05 DEHAM01-FW01 kernel: carp: 17@lagg1_vlan47: BACKUP -> MASTER (master timed out)
Feb 18 22:10:07 DEHAM01-FW01 kernel: carp: demoted by 240 to 480 (send error 50 on lagg1_vlan40)
Feb 18 22:10:07 DEHAM01-FW01 kernel: carp: demoted by 240 to 720 (send error 50 on lagg1_vlan10)
Feb 18 22:10:07 DEHAM01-FW01 kernel: carp: demoted by 240 to 960 (send error 50 on lagg1_vlan47)
Feb 18 22:10:07 DEHAM01-FW01 kernel: carp: demoted by 240 to 1200 (send error 50 on lagg1_vlan4001)
Feb 18 22:10:07 DEHAM01-FW01 kernel: carp: demoted by 240 to 1440 (send error 50 on lagg1_vlan4000)
Feb 18 22:10:07 DEHAM01-FW01 kernel: carp: demoted by 240 to 1680 (send error 50 on lagg1_vlan1150)
Feb 18 22:10:07 DEHAM01-FW01 kernel: carp: demoted by 240 to 1920 (send error 50 on lagg1_vlan1020)
Feb 18 22:10:07 DEHAM01-FW01 kernel: carp: demoted by 240 to 2160 (send error 50 on lagg1_vlan1011)
Feb 18 22:10:07 DEHAM01-FW01 kernel: carp: demoted by 240 to 2400 (send error 50 on lagg1_vlan1003)
Feb 18 22:10:07 DEHAM01-FW01 kernel: carp: demoted by 240 to 2640 (send error 50 on lagg1_vlan1002)
Feb 18 22:10:07 DEHAM01-FW01 kernel: carp: demoted by 240 to 2880 (send error 50 on lagg1_vlan1001)
Feb 18 22:10:07 DEHAM01-FW01 kernel: carp: demoted by 240 to 3120 (send error 50 on lagg1_vlan1000)
Feb 18 22:10:07 DEHAM01-FW01 kernel: carp: demoted by 240 to 3360 (send error 50 on lagg1_vlan150)
Feb 18 22:10:07 DEHAM01-FW01 kernel: carp: demoted by 240 to 3600 (send error 50 on lagg1_vlan44)
Feb 18 22:10:07 DEHAM01-FW01 kernel: carp: demoted by 240 to 3840 (send error 50 on lagg1_vlan43)
Feb 18 22:10:07 DEHAM01-FW01 kernel: carp: demoted by 240 to 4080 (send error 50 on lagg1_vlan42)
Feb 18 22:11:07 DEHAM01-FW01 kernel: carp: demoted by -240 to 3840 (pfsync bulk fail)

Maybe someone here have an Idea what happens.

Thank you!

Moin zusammen,

solangsam bin ich mit meinem Latein am Ende.

Folgende Situation:

2x DL360p Gen8 als Firewall OPNsense 19.1 installiert

LAGG / LACP für folgende Interface Konfiguriert: bge0 / bge1 (WAN)
bxe0 / BXE1 - Trunk und zig vlans Konfiguriert

WAN mit meinem Transfernetz konfiguriert
Allen interfacen auf beiden Nodes jeweils 251 Node 1 und 252 Node 2, CARP IPs immer die 254 bzw. die .142.178 als CARP für das WAN.

HA ist auf einem eigenen Interface direkt mit dem anderen Node verbunden, das funktioniert auch.

Nur ich bekomme immer folgenden Fehler:

CARP has detected a problem and this unit has been demoted to BACKUP status.
Check link status on all interfaces with configured CARP VIPs.

Und ich weiß einfach nicht WO?! Gibts irgendwie ne möglichkeit herauszufinden welches Problem er denn hat?

Danke !

Viele Grüße
Sven-Jendrik

Moin zusammen,

irgendwie habe ich gerade meinen 2. Node gekillt und ich weiß nicht warum.

Warning: Illegal string offset 'descr' in /usr/local/etc/inc/config.inc on line 317 Warning: Illegal string offset 'ipaddrv6' in /usr/local/etc/inc/config.inc on line 318 Warning: Cannot assign an empty string to a string offset in /usr/local/etc/inc/config.inc on line 318 Warning: Illegal string offset 'ipaddr' in /usr/local/etc/inc/config.inc on line 319 Warning: Cannot assign an empty string to a string offset in /usr/local/etc/inc/config.inc on line 319 Warning: Illegal string offset 'descr' in /usr/local/etc/inc/config.inc on line 325

Irgendwer ne Idee wie man das wieder heile bekommt, ohne wieder alles neu zu installieren?

VIele Grüße
Sven-J

Moin zusammen,

da ich leider nichts finde im Netz, gibt es irgendwie Einschränkungen für die Namen der einzelnen Interface (ob nun vLANs, oder HW Interface) wenn man CARP Benutzen möchte?

Ich nenne nämlich meine Interface nach folgendem Schema: vLANXXXX_19216810DMZ auf beiden Nodes aber leider funktioniert das mit dem Mapping auf dem Backup nicht und wenn ich das per Hand auf dem Backup ändere wird das natürlich sofort wieder überschrieben.

Danke !

Viele Grüße
Sven-J