I don't like leaving things not fully stable so I bit the bullet and clicked "Remove Enable/Disable changes in the current Category" so it would at least sync. To my surprise it did not help, even after doing it on router2 as well. Then I noticed the CARP sync was also starting to fail.
After thinking about it a bit I restarted router2 and syncing immediately worked again. That implies something was wrong with the XMLRPC sync that wasn't fixed by restarting webConfigurator and/or PHP-FPM. Notably there was a config sync fix included in pfSense 2.2.6... I noticed another interesting tidbit. The first Suricata sync after the restart I used a hostname (to router2's LAN IP). The sync took 4 seconds. I then changed to an IP address. It succeeded but took just shy of 3 minutes. Back to the hostname...1 second. Back to the IP...timeouts and "Code 2: Invalid return payload." At that point I had to restart router2 again. I can't imagine using a hostname makes any practical difference. I had started with an IP for the Suricata sync because the High Availability Sync page says to use an IP. I did notice that the pfSense config sync triggers a route reload and down/up of the OpenVPN interface (which isn't connected), and the OpenVPN down/up logs, in order: /rc.newwanip: rc.newwanip: Info: starting on ovpns1. /rc.newwanip: rc.newwanip: on (IP address: 192.168.199.1) (interface: []) (real interface: ovpns1). check_reload_status: Reloading filter php-fpm[49144]: /rc.newwanip: pfSense package system has detected an IP change or dynamic WAN reconnection - -> 192.168.199.1 - Restarting packages. check_reload_status: Starting packages /rc.start_packages: Restarting/Starting all packages. ...maybe "restarting packages" is interfering with the Suricata sync? Or possibly the default Suricata sync timeout of 150 seconds needs to be a *lot* higher? -- Steve Yates ITS, Inc. _______________________________________________ pfSense mailing list https://lists.pfsense.org/mailman/listinfo/list Support the project with Gold! https://pfsense.org/gold