Using pfsync leads to rapid state loss?

Yar Tikhiy yar at comp.chem.msu.su
Tue Mar 22 06:49:46 PST 2005


Hi folks,

I know I'm unoriginal in my trying to use pf + pfsync + carp :-)
But am I unique in observing the following trouble?

I have two symmetric routers running rather fresh RELENG_5 (just a
few days old) and CARP from the patch by Glebius.  As soon as I
enable pfsync between them over a dedicated pair of interfaces,
they really start to exchange state updates, but at the same time
established TCP states start to expire extremely fast.  By coincidence
I noticed that when "timeout interval" was 20, an idle TCP state
lasted for 12-13 seconds in both PF's; but when "timeout interval"
was 8, a TCP state vanished after 2-3 seconds of inactivity.  The
whole issue looks like the other PF expires a state too fast and
sends the corresponding update back to the PF originating the state.
Disabling pfsync between the routers remedies the problem at once.

Did I hit a known pitfall?

-- 
Yar


More information about the freebsd-pf mailing list