Bug #16270
closed
Clarify ECMP Flow Hashing Behavior and net.route.hash_outbound Sysctl Status in pfSense CE 2.8 / FreeBSD 15
0%
Description
In pfSense CE 2.8.0 (FreeBSD 15), ECMP (Equal-Cost Multi-Path Routing) support is advertised as active, and per Redmine ticket #9545, it has been confirmed by Netgate staff that ECMP with 5-tuple flow hashing is functional in both pfSense Plus (23.05.1+) and CE (2.7.0+), provided traffic includes multiple distinct flows.
However, during our review and validation of ECMP behavior in pfSense CE 2.8.0, we observed that the net.route.hash_outbound tunable remains at 0, even when explicitly passed at boot time using /boot/loader.conf.local or entered manually at the loader prompt. The tunable appears in kenv, confirming it is accepted by the loader, but the kernel does not reflect this at runtime.
Key Points:
net.route.multipath=1 confirms multipath support is enabled in the kernel.net.route.hash_outbound="1" is accepted by the loader (visible in kenv).sysctl net.route.hash_outbound always returns 0, regardless of loader settings.Based on ticket #9545, ECMP hashing is presumed to be active by default in the kernel, but this is not clearly documented or reflected in the sysctl behavior.Request:
We respectfully request clarification on the following:
Is net.route.hash_outbound still used in pfSense CE 2.8.0, or is it now obsolete or ignored by the kernel?If ECMP flow hashing is now always active by default (as implied in ticket #9545), should this tunable be updated, removed, or documented accordingly?Can the documentation or GUI be updated to clarify current ECMP flow hashing behavior and runtime observability?If hashing is enabled by default, should the sysctl reflect that (i.e., return 1)?We believe a clear answer will help administrators accurately verify ECMP deployment status and avoid confusion when tuning systems for IPsec multi-tunnel aggregation or BGP-based multipath routing.
Environment:
pfSense CE 2.8.0-RELEASEFreeBSD 15 (Netgate kernel)Dual IPsec tunnel with BGP route injectionFRR package configured via GUI
Updated by Jim Pingle about 1 month ago
- Status changed from New to Not a Bug
The docs do not mention net.route.hash_outbound so there is nothing to update. That is a read-only sysctl which the OS uses to indicate if it has activated flowid calculation. The OS will set that sysctl to 1 when the first multi-path route is present in the route table.
The sysctl which indicates if support is present for ECMP is net.route.multipath which is 1.
: sysctl net.route.multipath
net.route.multipath: 1
: sysctl net.route.hash_outbound
net.route.hash_outbound: 0
: route add 192.0.2.0/30 198.51.100.1
add net 192.0.2.0: gateway 198.51.100.1
: route add 192.0.2.0/30 203.0.113.1
add net 192.0.2.0: gateway 203.0.113.1
: sysctl net.route.hash_outbound
net.route.hash_outbound: 1
: netstat -4OnW
Nexthop groups data
Internet:
GrpIdx NhIdx Weight Slots Gateway Netif Refcnt
30 ------- ------- ------- ----------------- --------- 2
28 1 1 198.51.100.1 vtnet0
29 1 1 203.0.113.1 vtnet3
The docs at https://docs.netgate.com/pfsense/en/latest/routing/multipath.html cover it sufficiently