After further investigation, it seems this is not only related to multicast, but also with unicast udp packets. So I have moved on to my new firewalls under ubuntu server 20.04 with conntrackd 1.4.5. I added the "StartupResync on" and The initial states are getting in the backup firewall. But all state changes are not updated. I noticed the rsqueue "current elements" is rising constantly. # conntrackd -s queue allocated queue nodes: 0 queue txqueue: current elements: 0 maximum elements: 2147483647 not enough space errors: 0 queue errorq: current elements: 0 maximum elements: 128 not enough space errors: 0 queue rsqueue: current elements: 5863 maximum elements: 131072 not enough space errors: 0 Any idea what could cause this? Thank you. Le ven. 27 nov. 2020, à 14 h 04, Jean-Sébastien Frerot <jsfrerot@xxxxxxxxx> a écrit : > > Ok, I can understand if it's not working with more than 2 firewalls. > But it's not working with 2 ! > The details I sent are only for 2 firewalls ATM. > > > Le ven. 27 nov. 2020, à 13 h 57, Pablo Neira Ayuso > <pablo@xxxxxxxxxxxxx> a écrit : > > > > On Fri, Nov 27, 2020 at 11:56:22AM -0500, Jean-Sébastien Frerot wrote: > > > Hi, I'm trying to set up conntrackd in FTFW mode with the multicast protocol. > > > The problem I'm having is that my BACKUP firewall is not getting the > > > states as it's supposed to. > > > It's receiving the packets (confirmed by a tcpdump), but only a few > > > states are replicated, even when I used the '-B' option to resend all > > > the states to the slaves. > > > > > > If I configure it to use unicast UPD, all is working fine. > > > I was hoping to use multicast so I can migrate my current active > > > firewalls, to a new pair of firewalls. But for this to work, I need to > > > sync the states to all my 4 firewalls. > > > > FT-FW only works with 2 firewalls. For more than 2 firewalls, please > > try NOTRACK mode. > > > > FT-FW would need to be extended to support more than 2 firewalls, by > > adding some sort of node ID and independent retransmissions queues for > > each firewall in the cluster.
