Regression #11795: Applying IPsec settings for more than ~30 tunnels times out PHP - pfSense - pfSense bugtracker

Actions

Copy link

Regression #11795

closed

Applying IPsec settings for more than ~30 tunnels times out PHP

Added by Jim Pingle over 3 years ago. Updated over 3 years ago.

Status:

Resolved

Priority:

High

Assignee:

Category:

IPsec

Target version:

2.5.2

Start date:

04/09/2021

Due date:

% Done:

100%

Estimated time:

Plus Target Version:

21.05

Release Notes:

Default

Affected Version:

2.5.x

Affected Architecture:

Description

When attempting to apply IPsec changes on a system with more than around 30 tunnels, the apply process causes a timeout in PHP.

When creating a new Phase 1 entry and then attempting to apply changes, the GUI page loads for 2-3 minutes and then finally ends with a 504 gateway timeout error. In the past, similar actions have taken around 20 seconds.

The change does appear to have taken when going back into the GUI after a while.

See also https://forum.netgate.com/topic/162168/ipsec-apply-changes-time-out/18 and internal issue NG #6011

Files

Download all files

image (1).png (31.7 KB) image (1).png		Core Team, 04/21/2021 01:39 PM
ipsec-config-40-tunnels.xml (67.3 KB) ipsec-config-40-tunnels.xml		Jim Pingle, 04/23/2021 01:31 PM

Actions

Copy link

Updated by Core Team over 3 years ago

File image (1).png image (1).png added

Currently running on 21.02.2-RC code on zColo vpn concentrators, along with a patch to fix VTI creation issues after already having 33 ipsec tunnels in place.

Issue is that if I create a new p1 tunnel, and save, and then click 'apply changes', it times out after 2-3 minutes of appearing to load. Attached is screenshot.

Actions

Copy link

Updated by Jim Pingle over 3 years ago

File ipsec-config-40-tunnels.xml ipsec-config-40-tunnels.xml added

There must be more to it than just the number of tunnels. I generated a config with 40 dummy tunnels and it applies the configuration in ~35 seconds without errors several times in a row on 21.05 on new hardware.

I tried on 21.02.2 in a smaller VM (less RAM, lower performance) and it still applied in about 45 seconds.

Actions

Copy link