And what I see after the weekend: allocated queue nodes: 131072 queue txqueue: current elements: 0 maximum elements: 2147483647 not enough space errors: 0 queue errorq: current elements: 0 maximum elements: 128 not enough space errors: 0 queue rsqueue: current elements: 131072 maximum elements: 131072 not enough space errors: 109663 Le ven. 4 déc. 2020, à 13 h 21, Jean-Sébastien Frerot <jsfrerot@xxxxxxxxx> a écrit : > > After further investigation, it seems this is not only related to > multicast, but also with unicast udp packets. > So I have moved on to my new firewalls under ubuntu server 20.04 with > conntrackd 1.4.5. > I added the "StartupResync on" and The initial states are getting in > the backup firewall. But all state changes are not updated. > > I noticed the rsqueue "current elements" is rising constantly. > # conntrackd -s queue > allocated queue nodes: 0 > > queue txqueue: > current elements: 0 > maximum elements: 2147483647 > not enough space errors: 0 > > queue errorq: > current elements: 0 > maximum elements: 128 > not enough space errors: 0 > > queue rsqueue: > current elements: 5863 > maximum elements: 131072 > not enough space errors: 0 > > Any idea what could cause this? > > Thank you. > > Le ven. 27 nov. 2020, à 14 h 04, Jean-Sébastien Frerot > <jsfrerot@xxxxxxxxx> a écrit : > > > > Ok, I can understand if it's not working with more than 2 firewalls. > > But it's not working with 2 ! > > The details I sent are only for 2 firewalls ATM. > > > > > > Le ven. 27 nov. 2020, à 13 h 57, Pablo Neira Ayuso > > <pablo@xxxxxxxxxxxxx> a écrit : > > > > > > On Fri, Nov 27, 2020 at 11:56:22AM -0500, Jean-Sébastien Frerot wrote: > > > > Hi, I'm trying to set up conntrackd in FTFW mode with the multicast protocol. > > > > The problem I'm having is that my BACKUP firewall is not getting the > > > > states as it's supposed to. > > > > It's receiving the packets (confirmed by a tcpdump), but only a few > > > > states are replicated, even when I used the '-B' option to resend all > > > > the states to the slaves. > > > > > > > > If I configure it to use unicast UPD, all is working fine. > > > > I was hoping to use multicast so I can migrate my current active > > > > firewalls, to a new pair of firewalls. But for this to work, I need to > > > > sync the states to all my 4 firewalls. > > > > > > FT-FW only works with 2 firewalls. For more than 2 firewalls, please > > > try NOTRACK mode. > > > > > > FT-FW would need to be extended to support more than 2 firewalls, by > > > adding some sort of node ID and independent retransmissions queues for > > > each firewall in the cluster.
