https://redmine.pfsense.org/https://redmine.pfsense.org/favicon.ico?16780521162015-01-29T16:38:23ZpfSense bugtrackerpfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=170692015-01-29T16:38:23ZErmal Luçieri@pfsense.org
<ul></ul><p>I think this happens because CARP packets are being sent to dummynet.<br />Before the kernel patch prevented this from happening.</p>
<p>Will investigate and fix it accordingly.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=171532015-02-03T16:44:08ZErmal Luçieri@pfsense.org
<ul><li><strong>Status</strong> changed from <i>Confirmed</i> to <i>Feedback</i></li></ul><p>Patch committed.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=173282015-02-13T16:45:52ZVitaliy Isarevvitaliy.isarev@yandex.ru
<ul></ul><p>Hi, I have the same issue. I tried to update to the latest maintance version, but receive error after upgrade: "shared object libpcre.so.1 not found required by php"</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=173682015-02-17T04:13:55ZVitaliy Isarevvitaliy.isarev@yandex.ru
<ul></ul><p>Ermal Luçi wrote:</p>
<blockquote>
<p>Patch committed.</p>
</blockquote>
<p>Can you post a link to the patch</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=175772015-03-03T13:03:19ZChris Buechlercbuechler@gmail.com
<ul><li><strong>Status</strong> changed from <i>Feedback</i> to <i>Resolved</i></li></ul><p>fixed</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=178812015-03-25T05:23:19ZSteve Wheeler
<ul></ul><p>We are seeing a number of reports that this is still an issue in 2.2.1. At least one customer ticket and also: <a class="external" href="https://forum.pfsense.org/index.php?topic=87541.0">https://forum.pfsense.org/index.php?topic=87541.0</a><br />Even if there is no longer a panic, though there is for some, the machine is no longer usable with the logs spammed with the erro message in the patch.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=179632015-04-02T10:43:51ZJim Pingle
<ul><li><strong>Status</strong> changed from <i>Resolved</i> to <i>Confirmed</i></li><li><strong>Target version</strong> changed from <i>2.2.1</i> to <i>2.2.2</i></li></ul><p>This is still a problem. Some cases still work but with TONS of console/log spam about pfsync_undefer_state rendering the console and logs practically unusable. There are still a couple people reporting panics as well, though they don't seem to be making it to the crash reporter (other reports are submitting fine, however).</p>
<p>Somewhat related, there appears to be a logic issue in the pfsync enable checkbox for those who upgraded from 2.0.x or before (before the HA settings were moved). The GUI shows the option unchecked, but the empty tag is in the config which is causing pfsync to be enabled. This can lead to these errors showing up on non-HA units until they enable and then disable pfsync.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=180302015-04-03T14:05:39ZErmal Luçieri@pfsense.org
<ul><li><strong>Status</strong> changed from <i>Confirmed</i> to <i>Feedback</i></li></ul><p>I pushed the messages under debug misc level and also another change to fix the root cause for it.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=180502015-04-06T16:08:25ZChris Linstruth
<ul></ul><p>Looks good here. Not stressing it but enabling/disabling limiters on the cluster works, the limiters are doing what I ask, and the limited states are syncing. Thanks.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=180702015-04-07T23:00:20ZChris Buechlercbuechler@gmail.com
<ul></ul><p>Chris: that still working fine for you?</p>
<p>After running for a few hours, the secondary still hangs in one of our test setups. Console is non-responsive, ESX shows VM using 100% CPU. That happens after about 4 hours of run time. The primary is fine throughout, and the limiters work on both v4 and v6.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=180752015-04-08T01:50:00ZChris Linstruth
<ul></ul><p>I haven't seen anything else but please understand that this is on a test bench not in production and I am not stressing it at all. If you look at ticket UJN-78146 you will see my description of a crash I have seen since starting to test yesterday's snapshot. Not sure if it is related. The HA pair has been up since but with no more than about 150 states.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=180972015-04-09T17:38:33ZChris Linstruth
<ul></ul><p>A bit more info. See this thread:</p>
<p><a class="external" href="https://forum.pfsense.org/index.php?topic=92128.0">https://forum.pfsense.org/index.php?topic=92128.0</a></p>
<p>Turning off the limiters makes that NAT translation work.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=181042015-04-10T23:06:49ZChris Buechlercbuechler@gmail.com
<ul><li><strong>Target version</strong> changed from <i>2.2.2</i> to <i>2.2.3</i></li></ul><p>this is better, though still the issue where the secondary may hit 100% CPU and hang in some circumstance. We'll revisit.</p>
<p>The issue with reflection and limiters is <a class="issue tracker-1 status-11 priority-4 priority-default closed" title="Bug: Nat Reflection bug when using limiters (Duplicate)" href="https://redmine.pfsense.org/issues/4590">#4590</a></p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=184112015-05-15T13:47:21ZErmal Luçieri@pfsense.org
<ul></ul><p>Patch was committed for this on tools repo and also the defer option in pfsync is now not used.<br />Both can be considered as the root cause of the issue here.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=184852015-05-19T23:23:56ZChris Buechlercbuechler@gmail.com
<ul><li><strong>Subject</strong> changed from <i>Limiters + HA results in kernel panic</i> to <i>Limiters + HA results in hangs on secondary</i></li><li><strong>Status</strong> changed from <i>Feedback</i> to <i>Confirmed</i></li><li><strong>Affected Version</strong> changed from <i>2.2</i> to <i>2.2.x</i></li></ul><p>no change, still hangs secondary within a couple hours</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=187112015-06-08T18:06:37ZErmal Luçieri@pfsense.org
<ul><li><strong>Assignee</strong> changed from <i>Ermal Luçi</i> to <i>Chris Buechler</i></li></ul><p>Chris need to confirm this happens still or not.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=187122015-06-08T18:11:09ZChris Buechlercbuechler@gmail.com
<ul><li><strong>Status</strong> changed from <i>Confirmed</i> to <i>Feedback</i></li></ul><p>I'm pretty sure it doesn't happen anymore, still have the test setup running to make sure. Given another ~48 hours, if it's still not an issue, this will be safe to consider fixed.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=188542015-06-17T13:37:29ZChris Buechlercbuechler@gmail.com
<ul><li><strong>Status</strong> changed from <i>Feedback</i> to <i>Confirmed</i></li><li><strong>Assignee</strong> changed from <i>Chris Buechler</i> to <i>Ermal Luçi</i></li></ul><p>no change, as long as you have some traffic passing through a limiter, the secondary hangs within ~1-4 hours.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=189152015-06-20T19:38:31ZChris Buechlercbuechler@gmail.com
<ul><li><strong>File</strong> <a href="/attachments/1274">redmine4310-crash.txt</a> <a class="icon-only icon-download" title="Download" href="/attachments/download/1274/redmine4310-crash.txt">redmine4310-crash.txt</a> added</li><li><strong>Target version</strong> changed from <i>2.2.3</i> to <i>2.3</i></li></ul><p>Tried after changing both hosts to use unicast pfsync, which had no impact. It seems to alternate between hanging the secondary, and triggering a kernel panic. Thus far using unicast, the secondary has only kernel paniced, not hung consuming 100% CPU. Same kernel panic happened on occasion when using multicast pfsync so not sure that's actually changed.</p>
<p>crash report attached</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=190992015-07-09T18:38:57ZBernardo Páduabernardo@redealumni.com
<ul><li><strong>File</strong> <a href="/attachments/1296">crash report 2.txt</a> <a class="icon-only icon-download" title="Download" href="/attachments/download/1296/crash%20report%202.txt">crash report 2.txt</a> added</li><li><strong>File</strong> <a href="/attachments/1297">crash report 1.txt</a> <a class="icon-only icon-download" title="Download" href="/attachments/download/1297/crash%20report%201.txt">crash report 1.txt</a> added</li></ul><p>This is also happening to me. I though the issue with the limiters was fixed in 2.2.2 and 2.2.3, so I posted a duplicate ticket on <a class="issue tracker-1 status-11 priority-4 priority-default closed" title="Bug: Kernel Panic on the backup server on a master/backup CARP setup with pfSync enabled (Duplicate)" href="https://redmine.pfsense.org/issues/4823">#4823</a>. But I've now disabled my limiters and saw that the backup/secondary firewall stopped crashing.</p>
<p>I'm posting my crash dumps (two different times the backup crashed) here in case they are of any help.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=202122015-08-31T21:25:31ZJim Thompsonjim@netgate.com
<ul><li><strong>Assignee</strong> changed from <i>Ermal Luçi</i> to <i>Luiz Souza</i></li></ul> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=232372015-12-07T18:11:17ZJames Starowitz
<ul></ul><p>lastnight rolled out our 2.2.5 units using c2758s in HA, the units worked fine in a test lab, although once i put it into production the backup router would hang to the point that it could not access the webui, the hang occurs nearly every 5-10minutes, the backup router reboots and then crashs again soon after.</p>
<p>i disabled "state sync" on both the master and the backup and it stopped crashing.</p>
<p>because we use limiters per source ip each client ip has its own limit, as a result the HFSC work around cant really do what im doing with limiters</p>
<p>we rarely go into failover, but when we do seamless state transfers are a life saver.</p>
<p>i submitted the crash reports and opened a support ticket if you need the details.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=245632016-01-28T08:47:46ZLee Shirylshiry@tealeaveshealth.com
<ul></ul><p>This problem seems to get worse after upgrading to 2.2.6. Now the secondary still hangs even with the limiters and state sync disabled.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=255332016-03-03T04:32:16ZManfred Bongard
<ul><li><strong>File</strong> <a href="/attachments/1557">02.03.2016 22_18.txt</a> <a class="icon-only icon-download" title="Download" href="/attachments/download/1557/02.03.2016%2022_18.txt">02.03.2016 22_18.txt</a> added</li></ul><p>I have the same issue. <br />Panic on my HA-Backup between 10 minutes and 3 hours. I have send you several crash reports via gui.<br />Limiter + Vlan + NAT</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=255632016-03-04T10:07:19ZWilliam St.Denis
<ul><li><strong>File</strong> <a href="/attachments/1558">02.03.2016 22_18.txt</a> <a class="icon-only icon-download" title="Download" href="/attachments/download/1558/02.03.2016%2022_18.txt">02.03.2016 22_18.txt</a> added</li></ul><p>I have noticed this issue as well. We have to disable sync when using limiters because it's crashing the system. I have attached my log as well<br />I am running Limiter + Vlan + NAT as well. When we started running limiters we noticed the WEB UI started to slow down and were getting an error /rc.filter_synchronize: An authentication failure occurred then we got the kernel panic.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=255642016-03-04T10:10:46ZWilliam St.Denis
<ul><li><strong>File</strong> <a href="/attachments/1559">Crash_02.04.2016.txt</a> <a class="icon-only icon-download" title="Download" href="/attachments/download/1559/Crash_02.04.2016.txt">Crash_02.04.2016.txt</a> added</li></ul><p>Sorry wrong log. Here is the correct one</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=255862016-03-05T16:19:30ZLuiz Souzaluiz@netgate.com
<ul><li><strong>Target version</strong> changed from <i>2.3</i> to <i>2.3.1</i></li></ul> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=257282016-03-16T08:48:53ZMikhail Platonov
<ul></ul><p>I have the same issue. <br />ha-backup crashed after 7 min</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=257592016-03-17T15:55:39ZWilliam St.Denis
<ul></ul><p>Does anyone have a work around to keep limiters and sync working? The only option I have come up with is to disable limiters or disable sync both aren't great.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=257662016-03-18T00:20:50ZChris Buechlercbuechler@gmail.com
<ul></ul><p>William St.Denis wrote:</p>
<blockquote>
<p>Does anyone have a work around to keep limiters and sync working? The only option I have come up with is to disable limiters or disable sync both aren't great.</p>
</blockquote>
<p>Those are your only two options for the time being. ALTQ can often be used in the same way as limiters and doesn't have such issues. Post to the forum if you'd like to discuss further.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=263832016-04-15T22:08:16ZChris Buechlercbuechler@gmail.com
<ul><li><strong>Target version</strong> changed from <i>2.3.1</i> to <i>2.3.2</i></li></ul> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=272842016-05-25T11:22:03ZJose Duarte
<ul></ul><p>From the tests we ran for the last couple of days we saw kernel panic using limiters in multiple vlans but no impact when using different queues inside those limiters.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=280472016-07-08T03:32:52ZChris Buechlercbuechler@gmail.com
<ul><li><strong>Target version</strong> changed from <i>2.3.2</i> to <i>2.4.0</i></li></ul> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=298562016-12-09T23:24:17ZLuiz Souzaluiz@netgate.com
<ul></ul><p>2.4 has a few new fixes for use-after-free pfsync states. The limiters issue is also fixed.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=298582016-12-10T06:03:05ZJim Pingle
<ul></ul><p>I updated a test cluster to a snapshot from a couple hours ago, which from the timestamp looks like it should have this fix, and both nodes got stuck in a panic loop.</p>
<pre>
Version String: FreeBSD 11.0-RELEASE-p3 #233 8ae63e9(RELENG_2_4): Sat Dec 10 03:56:41 CST 2016
root@buildbot2.netgate.com:/builder/ce/tmp/obj/builder/ce/tmp/FreeBSD-src/sys/pfSense
Panic String: pfsync_undefer_state: unable to find deferred state
</pre>
<p>Same panic string on both nodes, slightly different backtrace.</p>
<p>Primary:<br /><pre>
db:0:kdb.enter.default> bt
Tracing pid 12 tid 100044 td 0xfffff80003500500
kdb_enter() at kdb_enter+0x3b/frame 0xfffffe001a62e430
vpanic() at vpanic+0x19f/frame 0xfffffe001a62e4b0
panic() at panic+0x43/frame 0xfffffe001a62e510
pfsync_update_state() at pfsync_update_state+0x45b/frame 0xfffffe001a62e560
pf_test() at pf_test+0x1bcc/frame 0xfffffe001a62e7d0
pf_check_in() at pf_check_in+0x1d/frame 0xfffffe001a62e7f0
pfil_run_hooks() at pfil_run_hooks+0x8c/frame 0xfffffe001a62e880
ip_input() at ip_input+0x3eb/frame 0xfffffe001a62e8e0
netisr_dispatch_src() at netisr_dispatch_src+0xa5/frame 0xfffffe001a62e940
ether_demux() at ether_demux+0x15c/frame 0xfffffe001a62e970
ether_nh_input() at ether_nh_input+0x317/frame 0xfffffe001a62e9d0
netisr_dispatch_src() at netisr_dispatch_src+0xa5/frame 0xfffffe001a62ea30
ether_input() at ether_input+0x26/frame 0xfffffe001a62ea50
vmxnet3_rxq_eof() at vmxnet3_rxq_eof+0x708/frame 0xfffffe001a62eae0
vmxnet3_legacy_intr() at vmxnet3_legacy_intr+0x110/frame 0xfffffe001a62eb20
intr_event_execute_handlers() at intr_event_execute_handlers+0x20f/frame 0xfffffe001a62eb60
ithread_loop() at ithread_loop+0xc6/frame 0xfffffe001a62ebb0
fork_exit() at fork_exit+0x85/frame 0xfffffe001a62ebf0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe001a62ebf0
</pre></p>
<p>Secondary:<br /><pre>
db:0:kdb.enter.default> bt
Tracing pid 12 tid 100032 td 0xfffff800034c1500
kdb_enter() at kdb_enter+0x3b/frame 0xfffffe001a3cf240
vpanic() at vpanic+0x19f/frame 0xfffffe001a3cf2c0
panic() at panic+0x43/frame 0xfffffe001a3cf320
pfsync_update_state() at pfsync_update_state+0x45b/frame 0xfffffe001a3cf370
pf_test() at pf_test+0x245b/frame 0xfffffe001a3cf5e0
pf_check_out() at pf_check_out+0x1d/frame 0xfffffe001a3cf600
pfil_run_hooks() at pfil_run_hooks+0x8c/frame 0xfffffe001a3cf690
ip_output() at ip_output+0xd8b/frame 0xfffffe001a3cf7e0
ip_forward() at ip_forward+0x36b/frame 0xfffffe001a3cf880
ip_input() at ip_input+0x6da/frame 0xfffffe001a3cf8e0
netisr_dispatch_src() at netisr_dispatch_src+0xa5/frame 0xfffffe001a3cf940
ether_demux() at ether_demux+0x15c/frame 0xfffffe001a3cf970
ether_nh_input() at ether_nh_input+0x317/frame 0xfffffe001a3cf9d0
netisr_dispatch_src() at netisr_dispatch_src+0xa5/frame 0xfffffe001a3cfa30
ether_input() at ether_input+0x26/frame 0xfffffe001a3cfa50
vmxnet3_rxq_eof() at vmxnet3_rxq_eof+0x708/frame 0xfffffe001a3cfae0
vmxnet3_legacy_intr() at vmxnet3_legacy_intr+0x110/frame 0xfffffe001a3cfb20
intr_event_execute_handlers() at intr_event_execute_handlers+0x20f/frame 0xfffffe001a3cfb60
ithread_loop() at ithread_loop+0xc6/frame 0xfffffe001a3cfbb0
fork_exit() at fork_exit+0x85/frame 0xfffffe001a3cfbf0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe001a3cfbf0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
</pre></p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=303152017-01-04T01:14:16ZVladimir Usov
<ul></ul><p>Dear Luiz! Can we expect real fix in 2.4? We are waiting for it too long, and this is a really critical problem, since in a corporate environment you will always use both - HA and limiters. br Vladimir</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=305392017-01-10T20:29:35ZJames Kohout
<ul></ul><p>I would agree with Vladimir. Just would like to know if this will be definitely be fixed in 2.4 or pushed out further. <br />Thanks</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=307072017-01-18T06:06:05ZJose Duarte
<ul></ul><p>One more here, we always have limiters and HA and we are forced to use the queues. If someone makes a mistake of assigning a main limiter to a rule instant kernel panic...</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=323332017-03-23T16:31:47ZSteve Y
<ul></ul><p>We are not noticing our secondary (which is also a VM) hang. However, our one limited rule traffic ends overnight, so possibly it recovers after the messages end?</p>
<p>Reiterating from the referenced forum thread, there is a checkbox "No pfSync" on firewall rules, but checking that doesn't avoid the error message. Nor does setting "State type" to None.</p>
<p>We didn't see this issue until upgrading from 2.2.6 to 2.3.1_5.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=325162017-04-13T11:22:29ZJames Webb
<ul></ul><p>Still Producing issues for me. Had to re-install pfSense on both devices in HA after encountering this bug.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=327122017-05-07T19:22:33ZSean Huggans
<ul></ul><p>Experiencing this after updating from 2.1.5 to 2.3.4. Constant Kernel messages in system logs as: "pfsync_undefer_state: unable to find deferred state".</p>
<p>We had a limiter in place to limit bandwidth of our backup server when replicating through an IPSec tunnel to a backup server offsite in order to prevent packet loss caused by taking up all the bandwidth of our WAN.</p>
<p>Didn't actually notice until users reported not being able to access resources on the other side of the tunnel - apparently once backup replications started to the remote host, it killed the tunnel it was replicating through/being limited on somehow.</p>
<p>Any plans to resolve this issue? Limiters are a very useful feature, as is HA obviously.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=327522017-05-12T14:47:10ZMatthew Brown
<ul></ul><p>Hmmm.... this is very much no not ideal. :( I was going to do this in a new environment as we have soft limits in our datacenters. It would be very useful to simply limit our incoming and outgoing speed to a set amount. If we are over our allotted speed for more than x number of hours we will be forced to upgrade our connection Speed.</p>
<p>Does anyone know if this issue was fixed with the release of 2.4? I don't really want to install "bleeding edge" tech, but I also don't want to have to tell my boss our database networking costs will double because we are 1MBps's over limit. ^^;;;</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=329332017-06-08T16:44:37ZScott Rosenberg
<ul></ul><p>Has this had any development recently?</p>
<p>This is the primary reason I can't use limiters in my HA setup, and the assignee hasn't commented in 6 months.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=332732017-07-21T04:19:10ZJose Duarte
<ul></ul><p>For those still with problems you can use limiters in HA with any version w/out kernel panic but for that you need additional configuration.</p>
<p>1. Create a new limiter for both upload and download with the bandwidth limit. Name it with the name you want and _donotuse at the end (just for safety)<br />2. Create a new Queue inside of each limiter (When inside of the limiter "Add New Queue" green button)<br />3. Name the queues with the vlan/rule name and the bandwidth you set in the limit and with _up or _down (for reference) and set the weight to 100 for that queue to use 100% of the limiter<br />4. Assign the queues you created to the rules you want to limit the bandwidth. MAKE SURE YOU ASSIGN THE QUEUE AND NOT THE LIMITER, IF YOU CHOOSE THE LIMITER YOU WILL HAVE THE KERNEL PANIC IN THE 2nd MEMBER. That's why it's a better practice to use the name _donotuse in the limiters.</p>
<p>Notes:<br />You still need to create 1xlimiter + 1xqueue per each flow per rule<br />If you assign the same queues to multiple rules they will share the same "roof" defined in the limiter<br />You can create multiple queues for one limiter with different weight, very useful if you want to have, for example, a top limit of 400Mbit and give rule1 guaranteed 10% of those, rule2 50% and rule3 40%. If all of the rules/queues are being maxed out you will have a perfect bandwidth balance. If for example rule 2 and 3 don't have any traffic rule1 will be able to use the 400Mbit since we only define a guaranteed minimum.</p>
<p>Cheers.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=332852017-07-24T03:32:22ZLars Jorgensenlajo@kb.dk
<ul></ul><p>Jose Duarte wrote:</p>
<blockquote>
<p>For those still with problems you can use limiters in HA with any version w/out kernel panic but for that you need additional configuration.</p>
</blockquote>
<p>Thank you!</p>
<p>Confirmed working here. Great load off my chest as running without HA was never very fun.</p>
<p>Lars</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=338522017-09-11T15:57:20ZRenato Botelhorenato@netgate.com
<ul><li><strong>Target version</strong> changed from <i>2.4.0</i> to <i>2.4.1</i></li></ul> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=339242017-09-15T19:02:14ZJose Duarte
<ul></ul><p>Moved, yet again :(</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=342652017-10-12T10:09:03ZJim Pingle
<ul><li><strong>Target version</strong> changed from <i>2.4.1</i> to <i>2.4.2</i></li></ul> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=342762017-10-12T10:53:55ZSander Naudtss.naudts@gmail.com
<ul></ul><p>Why not change target version to 2.9.9... sorry just little frustrating that this doesn't get fixed.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=342772017-10-12T10:55:31ZJim Pingle
<ul></ul><p>We expected to have more time before 2.4.1 but we need to have it out in a week or so, there isn't time to get to this and the other things we have to address for it.</p>
<p>And if you read above, there is a viable workaround if you use queues/child limiters and not the limiters directly.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=342962017-10-13T01:22:57ZLars Jorgensenlajo@kb.dk
<ul></ul><p>Sander Naudts wrote:</p>
<blockquote>
<p>Why not change target version to 2.9.9... sorry just little frustrating that this doesn't get fixed.</p>
</blockquote>
<p>It's not that much of a problem as long as you use the workaround described in comment <a class="issue tracker-1 status-3 priority-4 priority-default closed" title="Bug: Nano issue2 (Resolved)" href="https://redmine.pfsense.org/issues/44">#44</a>. I've been running HA with limiters without any problems for three months now.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=345932017-10-23T12:18:41ZJim Pingle
<ul><li><strong>Target version</strong> changed from <i>2.4.2</i> to <i>2.4.3</i></li></ul> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=354662017-12-25T03:48:06ZEero Volotinen
<ul></ul><p>Lars Jorgensen wrote:</p>
<blockquote>
<p>Sander Naudts wrote:</p>
<blockquote>
<p>Why not change target version to 2.9.9... sorry just little frustrating that this doesn't get fixed.</p>
</blockquote>
<p>It's not that much of a problem as long as you use the workaround described in comment <a class="issue tracker-1 status-3 priority-4 priority-default closed" title="Bug: Nano issue2 (Resolved)" href="https://redmine.pfsense.org/issues/44">#44</a>. I've been running HA with limiters without any problems for three months now.</p>
</blockquote>
<p>still issue with 2.4.2 .. please at least add note to gui that you cannot use pfsync with limiters. It saves lot of time .. it took something like 2 days to figure, why ha units were crashing..</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=356422018-01-24T14:56:29ZLuiz Souzaluiz@netgate.com
<ul><li><strong>Status</strong> changed from <i>Confirmed</i> to <i>Feedback</i></li><li><strong>% Done</strong> changed from <i>0</i> to <i>100</i></li></ul><p>The crash is fixed on the last snapshot.</p>
<p>Tests are welcome.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=358862018-02-19T05:29:57ZFabrizio Pappolla
<ul><li><strong>File</strong> <a href="/attachments/2343">pfsense_crashlog.txt</a> <a class="icon-only icon-download" title="Download" href="/attachments/download/2343/pfsense_crashlog.txt">pfsense_crashlog.txt</a> added</li></ul><p>Before open a new ticket, i will try here since the error looks really similar. My pfSense got bootloop, the problem was caused by a black out, the error was: "kernel panic pfsync_undefer_state: unable to find deferred state". I have not HA on, only limiter and PRIQ. Attacched you can find the crash log. pfSense Version 2.4.2-RELEASE-p1 (amd64)</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=358872018-02-19T08:08:08ZJim Pingle
<ul></ul><p>Fabrizio Pappolla wrote:</p>
<blockquote>
<p>Before open a new ticket, i will try here since the error looks really similar. My pfSense got bootloop, the problem was caused by a black out, the error was: "kernel panic pfsync_undefer_state: unable to find deferred state". I have not HA on, only limiter and PRIQ. Attacched you can find the crash log. pfSense Version 2.4.2-RELEASE-p1 (amd64)</p>
</blockquote>
<p>The backtrace shows pfsync, so you must have that active. This has been fixed on 2.4.3, so additional problem reports on anything older are not helpful. Upgrade to a 2.4.3 snapshot and see if it is more stable there.</p> pfSense - Bug #4310: Limiters + HA results in hangs on secondaryhttps://redmine.pfsense.org/issues/4310?journal_id=360592018-03-12T08:08:21ZJim Pingle
<ul><li><strong>Status</strong> changed from <i>Feedback</i> to <i>Resolved</i></li></ul><p>Confirmed working by multiple tests and users.</p>