Project

General

Profile

Regression #11795

Applying IPsec settings for more than ~30 tunnels times out PHP

Added by Jim Pingle about 1 month ago. Updated 2 days ago.

Status:
Feedback
Priority:
High
Assignee:
Category:
IPsec
Target version:
Start date:
04/09/2021
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
21.05
Release Notes:
Default
Affected Version:
2.5.x
Affected Architecture:

Description

When attempting to apply IPsec changes on a system with more than around 30 tunnels, the apply process causes a timeout in PHP.

When creating a new Phase 1 entry and then attempting to apply changes, the GUI page loads for 2-3 minutes and then finally ends with a 504 gateway timeout error. In the past, similar actions have taken around 20 seconds.

The change does appear to have taken when going back into the GUI after a while.

See also https://forum.netgate.com/topic/162168/ipsec-apply-changes-time-out/18 and internal issue NG #6011

image (1).png (31.7 KB) image (1).png Core Team, 04/21/2021 01:39 PM
ipsec-config-40-tunnels.xml (67.3 KB) ipsec-config-40-tunnels.xml Jim Pingle, 04/23/2021 01:31 PM

History

#1 Updated by Core Team 22 days ago

Currently running on 21.02.2-RC code on zColo vpn concentrators, along with a patch to fix VTI creation issues after already having 33 ipsec tunnels in place.

Issue is that if I create a new p1 tunnel, and save, and then click 'apply changes', it times out after 2-3 minutes of appearing to load. Attached is screenshot.

#2 Updated by Jim Pingle 20 days ago

There must be more to it than just the number of tunnels. I generated a config with 40 dummy tunnels and it applies the configuration in ~35 seconds without errors several times in a row on 21.05 on new hardware.

I tried on 21.02.2 in a smaller VM (less RAM, lower performance) and it still applied in about 45 seconds.

#3 Updated by Core Team 17 days ago

I would add that it also takes a LONG time to pull ipsec status.

#4 Updated by Jim Pingle 13 days ago

  • Status changed from New to Feedback
  • Assignee set to Steve Beaver
  • Target version changed from CE-Next to 2.6.0
  • % Done changed from 0 to 100

#5 Updated by Jim Pingle 2 days ago

  • Plus Target Version set to 21.05

#6 Updated by Jim Pingle 2 days ago

Already in 21.05 branch.

Also available in: Atom PDF