Upgrade 26.1 -> 26.7 failed (with weirdness)

[miketubby]

Have been running 26.1 on a re-purposed Check Point 5800 for some time.

Was using the Firewall (old) Rules which was a blocker to upgrading to 26.7 so finally this evening I did:

1. Back up configuration
2. Run firewall rules migration
   - Exported rules to CSV
   - Reviewed rules
   - Imported to new rules
   - Flushed old rules
   - Saved changes
3. Rebooted system
4. System came back fine, tested networking and rules seemed fine
5. From the Dashboard/lobby did a Check for Updates
6. System upgraded from 26.1.10 to 26.1.11 and said "end of support for 21.1"
7. Manually rebooted
8. System came back and everything working as expected
9. Did Check for Updates again and was offered 26.7 with caveats like "will need multiple reboots"
10. Cancelled and backed up system again (just in case)
11. Resumed upgrade to 26.7
12. System installe new kernel and printed REBOOT surrounded in !!!!!!! and went to reboot but never came back
13. Pluged laptop in to serial console, get message "failed waiting for configd (doesn't seem to be running)" approx every 15 seconds.  Machine wedged.
14. Used long-press on power switch
15. System said uptime 13 min, syncing disks, etc. and shutdown
16. Powered up system again and it booted normally back in to 26.1.11 and is working
17. Check for Updates now broken with tens of error messages about wrong packages and database rebuilds needed

WTF happened?

Mike

[mtltt]

The same thing happened to me today when I was upgrading a VM.
I also got stuck on the message 'Failed waiting for configd (doesn't seem to be running)' and, after rebooting, ended up with a broken system. I had the same problem when I tried to check for updates afterwards.

To resolve the issue, I reinstalled version 26.1, restored the configuration, and uninstalled the Intel microcode plug-in — just in case that was the cause of the problem. However, technically, that couldn't have been the issue.
The upgrade to version 26.7 then worked.

I didn't upgrade another bare metal firewall after this experience.

[newsense]

> WTF happened?

Most likely you didn't remove the microcode plugin before the major upgrade.

Remove it and try again.

If you don't have the plugin installed on 26.1 then post the health check

[miketubby]

I recally cannot remember if I had the microcode plug-in installed, but if it's a problem can't the upgrade process be configured to remove it to save this happening?

Mike

[nero355]

I recally cannot remember if I had the microcode plug-in installed, but if it's a problem can't the upgrade process be configured to remove it to save this happening?

There are some temporary issues because of the whole FreeBSD 14.x to FreeBSD 15.x switch so you simply need to follow the current upgrading rule which is :

- While still on OPNsense 26.1.x please DISABLE the Intel CPU Microcode functionality or uninstall the plug-in.
- Then upgrade to OPNsense 26.7.x
- Then upgrade your FreeBSD Bootloader.
- Then you might be able to ENABLE the Intel CPU Microcode functionality or install the plug-in again.

For more information and the whole procedure please follow this topic : https://forum.opnsense.org/index.php?topic=52441.0