Gateway Monitoring

[supercm]

I will try changing the time to 5 seconds to see if it makes a difference.

[supercm]

I just got another failure from the second node. It shows in the UI that the interface is offline.

Ping from the interface is successful and no changes to the routes.

I disabled monitoring and re-enabled it and it shows as online.

[mimugmail]

Firewall : Settings : Advanced : Disable State Kill on Gateway failure .. please tick this

[supercm]

That is not a valid option under Advanced.

[mimugmail]

Really?

[supercm]

These are my options


IPv6 Options   full help
Allow IPv6    Allow IPv6
Network Address Translation   
Reflection for port forwards   
Reflection for 1:1   
Automatic outbound NAT for Reflection   
Bogon Networks   
Update Frequency   
Monthly
Gateway Monitoring   
Skip rules    Skip rules when gateway is down
Multi-WAN   
Sticky connections    Use sticky connections
Source tracking timeout
Shared forwarding    Use shared forwarding between packet filter, traffic shaper and captive portal
Disable force gateway    Disable automatic rules which force local services to use the assigned interface gateway.
Schedules   
Schedule States   
Miscellaneous   
Firewall Optimization   
normal
Firewall Rules Optimization   
basic
Bind states to interface   
Disable Firewall    Disable all packet filtering.
Firewall Adaptive Timeouts   
start   end
Firewall Maximum States   
Firewall Maximum Fragments   
Firewall Maximum Table Entries   
Static route filtering    Bypass firewall rules for traffic on the same interface
Disable reply-to    Disable reply-to on WAN rules
Disable anti-lockout    Disable administration anti-lockout rule
Aliases Resolve Interval   
Check certificate of aliases URLs    Verify HTTPS certificates when downloading alias URLs
Dynamic state reset    Reset all states when a dynamic IP address changes.

[mimugmail]

Ah, was removed with 22.1 so it seems OK then

[jclendineng]

Same issue here, ended up disabling monitoring till I can roll back to 21.7...

[supercm]

Any other recommendations on how to solve this issue? It seems to be constant with most of my interfaces.

[mimugmail]

Can you post the logs please?

[supercm]

Here you go

[darp12345]

I seem to have similar issue https://forum.opnsense.org/index.php?topic=27433.0
I have two WANs, both doing gateway monitoring. One is having the problem. The other seems fine. When it happens, the interface that is affected shows double ICMP replies of the dpinger pings.

Code Select Expand

tcpdump -n -i cxl1 icmp
...
23:51:43.962528 IP 98.51.182.15 > 4.2.2.3: ICMP echo request, id 33608, seq 0, length 8
23:51:43.981125 IP 4.2.2.3 > 98.51.182.15: ICMP echo reply, id 33608, seq 0, length 8
23:51:43.981169 IP 4.2.2.3 > 98.51.182.15: ICMP echo reply, id 33608, seq 0, length 8


[mimugmail]

I seem to have similar issue https://forum.opnsense.org/index.php?topic=27433.0
I have two WANs, both doing gateway monitoring. One is having the problem. The other seems fine. When it happens, the interface that is affected shows double ICMP replies of the dpinger pings.

Code Select Expand

tcpdump -n -i cxl1 icmp
...
23:51:43.962528 IP 98.51.182.15 > 4.2.2.3: ICMP echo request, id 33608, seq 0, length 8
23:51:43.981125 IP 4.2.2.3 > 98.51.182.15: ICMP echo reply, id 33608, seq 0, length 8
23:51:43.981169 IP 4.2.2.3 > 98.51.182.15: ICMP echo reply, id 33608, seq 0, length 8


Is this a virtual machine? Usually its fine to only monitor the primary line as there is no action when both are down