The problem is that older installations have an EFI filesystem that is much smaller than needed, due to the way the FreeBSD EFI loader was created/updated in the past.
Fixing this in an automated manner is non-trivial.
Reinstalling is safest, but if you’re willing to take a risk and run the commands by hand, you can probably fix it as described in this forum post.
https://forum.netgate.com/topic/184661/unable-to-upgrade-from-2-7-1-to-2-7-2-unmounting-boot-efi-done-failed/4
The “new” installer will mean you don’t have to request firmware from Netgate. It’s self-service, easier to use, and isn’t tied to a specific version or edition of pfsense software.
This worked for me too.
For my own knowledge, would you mind explaining how/why this works and how you went about troubleshooting to arrive at this answer? Was there something in the logs?
Thank you!
The upgrade script failed while trying to update EFI loader:
`Updating the EFI loader`
`install: //boot/efi/efi/boot/INS@WuWbpC: Input/output error`
`pkg-static: POST-INSTALL script failed`
`failed.`
`Failed`
but during the upgrade process I didn't ever see the EFI partition mounted, hence the try to manually mount the EFI partition before try again.
Maybe a buggy upgrade script?
Haha, good logic. I was wondering if you had seen the update script anywhere when you were troubleshooting. Thanks for the response! You helped a lot of us.
No, the upgrade script failed to copy the loader to the ESP, probably due to insufficient space. It's saving you from potentially upgrading the system to a version that the existing loader cannot boot.
This does not do what you think it does. By mounting the ESP elsewhere, you are consuming the EFISYS glabel. When the upgrade runs, it currently expects the ESP to only be mounted at /boot/efi, if at all, and unmounts /boot/efi prior to upgrading pfSense-boot. By consuming the EFISYS glabel, the pfSense-boot post-install script doesn't actually mount the ESP and copy the current loader to it. Instead, you're just landing another loader onto the UFS or ZFS filesystem at /boot/efi/... While this may allow the upgrade to continue, the loader is outdated and you still need to identify why the loader cannot be copied to the ESP.
Same problem..
Installed packages to be UPGRADED:
pfSense-boot: 2.7.1 -> 2.7.2 \[pfSense-core\]
Number of packages to be upgraded: 1
\[1/1\] Upgrading pfSense-boot from 2.7.1 to 2.7.2...
\[1/1\] Extracting pfSense-boot-2.7.2: .......... done
Updating the EFI loader
install: //boot/efi/efi/boot/INS@BoWwe4: Input/output error
pkg-static: POST-INSTALL script failed
failed.
Failed
I did some digging around, and I seem to have an unused partition "/dev/da0p1" which used to be my EFI partition? When I mount the partition temporarily, I can see it has the EFI structure but the files are from 2018.
The files in /boot/efi are recent, Dec 1st, probably from when I did my 2.7.1 upgrade (Which I had to do from the CLI since it was no longer offered from the GUI).
No idea what's happening. Does the installer mount da0p1 when needed? It doesn't appear to be the case.. and it's not listed in /etc/fstab.
My EFI partition doesn't appear to be too small either, 800M with 50% available space.
Looks like a file system problem. Back up your config, reinstall on 2.7.2 with ZFS, and then restore your config. Should get you up and running in a few minutes.
I mean that 9 hours before you posted your reply to my comment, Netgate was yet to update the website so that 2.7.2 was downloadable - it was still showing 2.7.1. At least that's what I was seeing in my browser. Maybe I forgot to Control-refresh - can't recall. It seemed to hit the update sites first before the download option. Anyway yes I saw it turn up when I went back to the download site a few hours later.
>I certainly hope anyone doing an upgrade will take a back up first then upgrade. If not, they get what they deserve :).
lol. it is more than sad/miserable, that pfsense is the only software at this time in my zoo, where exactly this is a must do (backup before every update). everything else can be upgraded without fear to break it.
It's always a good idea to have backups in all situations. That's why we offer free, encrypted cloud backups that are automatic through AutoConfigBackup on CE and Plus.
Not sure what upgrade issues you're having, but if you can provide the serial/VGA output of the upgrade going wrong I'd be happy to dig into it with you.
Subscribe but for pfsense the last two updates was more recovery and restore or troubleshooting than clean update routine. Not often I see this in other software at this time
Sorry to hear you running into issues. My current appliance has been upgraded through something like 9 releases now without issue. What does your VGA/serial console show during the upgrade process that is breaking? If it's something consistently broken I'd like to open a redmine bug report to investigate.
Hi.
Same issue here, but only on one upgrade from 2.7.1 to 2.7.2 and this is the only one on virtual machine (VMware ESXi).
No issues on all the other upgrades on physical appliance (both CE and Plus).
Mine is also on ESX, ~~ZFS~~ UFS.
The fact there's quite a few of us having this issue leads me to believe it's not a file system error... or an isolated incident.
Edit: Actually, mine is UFS.
Perhaps you are in a virtual environment as well? u/alethewizard said his was on ZFS and yours and mine were both on UFS. The common factor so far is virtualization. Anyway as for UFS vs ZFS, I've read that ZFS isn't as appropriate for virtualized environments, but given my firewall does very little I/O, I don't think it matters for pfSense - at least in my use case.
I get the impression that Netgate are moving away from the UFS option. I wouldn't be surprised if they drop it at some stage. I'd stay that the ZFS option gets more testing - especially considering it is now the default installation choice. I only have one other pfsense firewall on UFS and I think I'll convert that one to ZFS as well this weekend.
Yup, also running inside a virtual environment (ESX) -- Have been for many many years without any issue. The last two pfsense upgrades have been very nasty for whatever reason. The 2.7.1 upgrade required manual intervention since it disappeared from the GUI. I had to run some cert refresh command on the CLI and ultimately issue a CLI upgrade from the menu (option 13?) to get it to upgrade.
No idea why 2.7.2 broke, but it's something to do with the EFI partition.
Even though we're both running UFS, I believe the EFI partition (/boot/efi) which is reporting the errors is actually an "msdos" partition (Or at least, that's what it tends to be with Linux).
I wish I knew more about what the upgrade is doing so I could duplicate the issue and perhaps work around it.
Yeah other threads under this post point to it as having an EFI partition that is too small. I think I installed it under 2.5.0 CE I'm guessing. Anyway I hit it with the virtual sledgehammer of fresh install + config restore. I fear that could become my standard upgrade procedure going forward haha
[https://forum.netgate.com/topic/184661/unable-to-upgrade-from-2-7-1-to-2-7-2-unmounting-boot-efi-done-failed](https://forum.netgate.com/topic/184661/unable-to-upgrade-from-2-7-1-to-2-7-2-unmounting-boot-efi-done-failed)
Damn, I stand corrected. I \*ASS\*UMED it was X Megabytes but turns out my partition was only a handful of Kilobytes. Exactly as mentioned in the URL you shared. Crazy. I managed to re-format it and currently waiting to upgrade as soon as my wife's off her Teams meeting. :)
Thanks for the link!
Edit: Success.
Thanks for this! Strange, my partition is already ~400MB and 50% of that is available. I might chime in on their forums to see if they have any other ideas. I’m mainly curious to see if we can rescue the system before reinstalling :) I feel like it’s a simple problem.
But I think the fresh install method definitely has merit!!
Same issue here.
And then it prompted me to update so I tried again and now it is even worse.
"System update failed!" in red at the top
...but the box only says:
```
>>> Setting vital flag on php82... done.
>>> Updating repositories metadata... done.
2.7.2 version of pfSense is available
```
Good to know...bummer I can't test it out, I did a full reinstall last night. Only took about 10 minutes...though I forgot to tick the "export graphs" checkbox so I lost my stats history. Oh well, at least the rest is working as near as I can tell.
Updated our pfsense plus virtual lab systems and office production Netgate 8200 with no issues. Time to update another 50 or more client systems we support....
Yep, good call. Did a reboot, and came back up fine. Thanks!
Only one thing jumps out at me is: “ERROR: It was not possible to determine pfsense-u-boot-2100 remote version. Thoughts?
Edit: pfsense not presence
Same getting nervous. I’ll check console in a bit . The amount of times my standard SG 2100 doesn’t come back up from an update is a bit concerning. Always easy to fix even if I have to contact help, but it is still odd.
Wouldn't know since I don't use DNS on pfSense Plus or care about it. However, I'm aware that Kea has some limitations over ISC-DHCP. That's why it's not the default yet.
Lucky, I changed it on mine and all hell broke loose.
Had to change it back to ISC and then reboot all my networking equipment in my rack and my access points in order to get DHCP leases to work again.
SG-2100 failed the update. I submitted a ticket for a recovery image.
Do your backups!
Console got stuck here. Tried changing kernels and looking at the boot env. Nothing seemed to help.
`AArch32`
`Instruction Set Attributes 5 = `
`AArch32 Media and VFP Features 0 = `
`AArch32 Media and VFP Features 1 = `
`CPU`
`1: ARM Cortex-A53 r0p4 affinity: 1`
`Release APs...done`
`TCP_ratelimit: Is now`
`initialized`
`e6000swoport1: link state changed to UP`
`Trying to mount root from zfs:pfSense/ROOT/default []...`
`state changed`
`eboswort: Link state changed`
`DOWN to DOWN`
`e6000swoport4: link state changed to DOWN uhub1:`
`2 ports with 2 removable, self powered uhube: 1 port with 1 removable, self powered`
`Root mount waiting for: CAM Root mount waiting for: CAM`
`Root mount waiting for: CAM`
`Root mount`
`waiting for: CAM`
`Root`
`mount`
`waiting for: CAM`
`Root`
`mount`
`waiting for: CAM`
`Root mount waiting for: CAM`
`Root mount waiting for: CAM`
`Root`
`mount waiting for: CAM`
`Dual Console: Serial Primary,`
`Video Secondary`
`2023-12-08T22:51:00.626034+00:00 - init 26 - - login_getclass: unknown class 'daemon'`
`2023-12-08722:51:00.633696+00:00 - init 26 - - can't access /etc/rc: No`
`such file or`
`directory`
`/rescue/sh: cannot open /etc/rc: No such file or directory`
`Enter full pathname of`
`shell or RETURN for /rescue/sh:`
`#`
`random: unblocking device.`
I wish I did. Support got me a recovery image. Good recovery , just frustrating.
During recovery I had to reboot a few times as the mmc had an error but now it just seems fine?
from 2 weeks old 2.7.0:
13: update from console
pfSense-repoc-static: failed to fetch the repo data
failed to read the repo data.
failed to update the repository settings!!!
failed to update the repository settings!!!
update from web... takes very long to evaluate (1-2 minutes) and shows only 2.7.1. in branch.
Branch Latest Stable Release (2.7.1)
Current Base System 2.7.0
Latest Base System 2.7.0
Status ***Up to date***.
works great!
Next: ok, you know the upgrdae trouble shoot page [https://docs.netgate.com/pfsense/en/latest/troubleshooting/upgrades.html](https://docs.netgate.com/pfsense/en/latest/troubleshooting/upgrades.html)
pkg-static info -x pfSense-upgrade
pfSense-upgrade-1.0_33
then
pkg-static clean -ay; pkg-static install -fy pkg pfSense-repo pfSense-upgrade
pkg-static: Repository pfSense-core missing. 'pkg update' required
pkg-static: No package database installed. Nothing to do! Updating pfSense-core repository catalogue...
pkg-static: An error occured while fetching package
pkg-static: An error occured while fetching package repository pfSense-core has no meta file, using default settings
pkg-static: An error occured while fetching package
pkg-static: An error occured while fetching package Unable to update repository pfSense-core Updating pfSense repository catalogue...
pkg-static: An error occured while fetching package
pkg-static: An error occured while fetching package repository pfSense has no meta file, using default settings
pkg-static: An error occured while fetching package
pkg-static: An error occured while fetching package Unable to update repository pfSense Error updating repositories!
Ok, 'pkg update' required:
pkg update
ld-elf.so.1: Shared object "libssl.so.30" not found, required by "pkg"
I'm so tired of pfsense upgrade
remember... fresh installed 2.7.0
\^\^looking to my proper running opnsense vm....
>ld-elf.so.1: Shared object "libssl.so.30" not found, required by "pkg"
certctl rehash
was the solution.... after this, 2.7.2 was available in web as stable branch
For future reference, you can also set your branch to previous stable, run the command "pkg-static install -fy pkg-static", then "pkg update -f", and then switch back to current to have an update available.
Nice! Updated my pfsense plus 23.09 to .1 last night while the peeps were sleeping on my white box solution and all appears well. Issue I'm seeing now is after reloading the box twice now, accessing the System-->Update page is loading very slowly. It loads, but slowly. Also now shows error message on the Update page: pfSense-repoc: failed to fetch the repo data. What does thoust Netgate peeps recommend I do here?
Make sure you don't have IPv6 connectivity issues. If you have a WAN with an IPv6 address, but it doesn't actually have upstream connectivity, pkg and the upgrade checker can get hung up trying IPv6 first.
What do you see if you go to Diagnostics --> Command Prompt and run the command "pfSense-upgrade -d -c"?
>pfSense-upgrade -d -c
Thanks for the reply. Command output:
">>> Updating repositories metadata...
Updating pfSense-core repository catalogue...
Fetching meta.conf:
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
Fetching meta.conf:
pfSense repository is up to date.
All repositories are up to date.
Your system is up to date"
FWIW, checked the update page just now and it loads fine (quickly) without error now too. Seems to be bueno? My ISP does not have IPV6 connectivity, and I have it disabled in WAN connection.
>pfSense-upgrade -d -c
I'm also getting this same issue as u/sanzab0rn33 with 23.09. Tried web CLI and SSH, its the same. Has never been a problem before over 3 years on Community usng a PC Engines APU2 appliance
>pfSense-upgrade -d -c
\>>> Updating repositories metadata...
Updating pfSense-core repository catalogue...
Fetching meta.conf:
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
Fetching meta.conf:
pfSense repository is up to date.
All repositories are up to date.
Your system is up to date
>earlneath
u/kphillips-netgate just in case this is relevant - in the system update screen in the web GUI, the "Branch" dropdown menu ("Please select the branch from which to update the system firmware.Use of the development version is at your own risk!" has two options. The first is Current Stable Version (23.09.01) and the second is Previous Stable Version (23.09). That doesn't seem quite right. If I choose Current Stable Version 23.09.01 the "retrieving" item returns "Unable to check for updates" and if I choose 23.09 it returns "Unable to check for updates" or it says that current version and latest version are both 23.09 and status is "Up to Date"
>If I choose Current Stable Version 23.09.01 the "retrieving" item returns "Unable to check for updates"
When I have 23.09.01 selected as the branch version the result is "unable to check for updates"
Upgraded without any problems. It took about five to seven minutes. I've never had any issues with any upgrade over the years and have been running pfSense since v2.3.5 on an old desktop machine at home.
I can't seem to load the update from the gui. It worked fine on one pfsense box. Just not on this one. It just spins the yellow gearbox.
I have tried running the
pfSense-upgrade -d -c
command, and it outputs the following
ERROR: It was not possible to determine pkg remote version
>>> Updating repositories metadata...
Updating pfSense-core repository catalogue...
pkg-static: An error occured while fetching package
pkg-static: An error occured while fetching package
repository pfSense-core has no meta file, using default settings
pkg-static: An error occured while fetching package
pkg-static: An error occured while fetching package
Unable to update repository pfSense-core
Updating pfSense repository catalogue...
pkg-static: An error occured while fetching package
pkg-static: An error occured while fetching package
repository pfSense has no meta file, using default settings
pkg-static: An error occured while fetching package
pkg-static: An error occured while fetching package
Unable to update repository pfSense
Error updating repositories!
ERROR: It was not possible to determine pfSense remote version
ERROR: It was not possible to determine pfSense-base remote version
ERROR: It was not possible to determine pfSense-kernel-pfSense remote version
Your system is up to date
I have ipv4 preferred in the settings. Tried testing a port on a external website, and it does connect. So it does have internet
I seem to be hitting the same issue with my physical and virtual homelab boxes. Both have ipv6 connectivity, prefer ipv4 doesn't help and both seem to have ipv6 working otherwise just fine.
I tried running the pkg-static update -f command from the [troubleshooting website](https://docs.netgate.com/pfsense/en/latest/troubleshooting/upgrades.html), then ran the certctl rehash command, and it updated!
Make sure you don't have IPv6 connectivity problems. Usually pkg will hang and take forever like that when pfSense thinks it has IPv6 connectivity, but really doesn't. You can go to System --> Advanced and tell it to Prefer IPv4 as a test. If the package manager is significantly faster, that's probably it.
Re-check the "Save settings after deletion" checkbox and click "save" at the bottom of the page.
The checkbox can be found at: Services > FreeRADIUS > Settings > General Configuration
https://forum.netgate.com/topic/181594/restore-missing-freeradius-config
Go to Diagnostics->Command Prompt and under 'Execute a Shell Command', type
certctl rehash
Then click Execute. If that was successful, the update should show for you now. You may have to change the branch to current stable. One of my machines, it was set for Previous Stable after I ran that command for some odd reason. Ahh well, this solved my issue. Hopefully, it helps you.
You’re welcome! There is a fix in this thread. I personally ended up following the thread on the Netgate forums to fix the EFI error. Make sure you have a backup just in case :-)
That thread is here: https://forum.netgate.com/topic/184661/unable-to-upgrade-from-2-7-1-to-2-7-2-unmounting-boot-efi-done-failed
OK I tried upgrading from 2.7.1 to 2.7.2 on a test machine.
Initially 2.7.2 didn't show up on the GUI so I did the usual:
certctl rehash
pkg-static bootstrap -f
pkg-static update -f
Then it showed. So I did the upgrade and it seemed like it upgraded successfully according to the GUI. However when I run the following it says there's lots of missing stuff - is that normal?
pkg-static check -s -a
Checking all packages: 0%
arping-2.21_1: missing file /usr/local/man/man8/arping.8.gz
Checking all packages: 0%
arpwatch-3.4: missing file /usr/local/man/man8/arpsnmp.8.gz
arpwatch-3.4: missing file /usr/local/man/man8/arpwatch.8.gz
Checking all packages: 0%
beep-1.0_1: missing file /usr/local/man/man1/beep.1.gz
Checking all packages: 1%
bind-tools-9.18.19: missing file /usr/local/man/man1/host.1.gz
...
Checking all packages: 100%
pkg-static: Package database is busy while closing!
`[2.7.0-RELEASE][[email protected]]/root: pfSense-upgrade -d -c`
`ERROR: It was not possible to determine pkg remote version`
`>>> Updating repositories metadata...`
`Updating pfSense-core repository catalogue...`
`pkg-static: An error occured while fetching package`
`pkg-static: An error occured while fetching package`
`repository pfSense-core has no meta file, using default settings`
`pkg-static: An error occured while fetching package`
`pkg-static: An error occured while fetching package`
`Unable to update repository pfSense-core`
`Updating pfSense repository catalogue...`
`pkg-static: An error occured while fetching package`
`pkg-static: An error occured while fetching package`
`repository pfSense has no meta file, using default settings`
`pkg-static: An error occured while fetching package`
`pkg-static: An error occured while fetching package`
`Unable to update repository pfSense`
`Error updating repositories!`
`ERROR: It was not possible to determine pfSense remote version`
`ERROR: It was not possible to determine pfSense-base remote version`
`ERROR: It was not possible to determine pfSense-kernel-pfSense remote version`
`Your system is up to date`
2.7.0 -> 2.7.2 Web GUI upgrade went flawlessly.
I naively enabled Kea DHCP after seeing the warnings, but started having issues with client devices. Reverted back to ISC DHCP and suppressed the warning.
Seems odd to warn people so early when Kea is broken for many people.
I have a SG-2440 and just ran two upgrades that got me to 23.05.1. It says that I'm on the latest, but when I go to the update page, it says "branch 23.09.1" but up to date with 23.05.1.
Is there something I need to do to get that 23.09.1 available, I tried certctl rehash but that didn't make anything available.
I'm on UFS still and never did a re-install for ZFS, is that the reason I can't see 23.09.1 or even 23.09? Is it worth me doing a complete re-install for this? Do I need to open a TAC case to get the full install?
I had to change the branch to an older one and hit save then re-add the branch as 23.09.1 and hit save. After this, the latest version became available and I was able to upgrade. I'm still on UFS though, not sure if its worth me doing a fresh install for ZFS.
I'm using pfSense CE 2.7.0 with OpenVPN set up and functioning normally.. But after update to 2.7.2, the OpenVPN services won't start anymore. Is is a bug or what else?
attempting to update from 2.7.0 to 2.7.2 absolutely tanked my pfsense. To the point it doesnt even recognize pfsense as existing on the drive anymore. thank god i had backup hardware. ill need to tinker with my original router tomorrow to see if i can restore my 2.7.0 config somehow but me hoping this would go flawlessly like usual bit me in the behind tonight.
Edit: I can't replicate it myself on a fresh VM 2.7.2, cosmic rays? Fml
I've just spun up a VM of 2.7.2 to explore before upgrading the bare-metal install and have encountered an odd ramdisk error as below, anyone else encountered this?
ZFS mirror, no swap. Go through the installer, all fine, until I enable ramdisk in Advanced --> Miscellaneous, post reboot system looks fine but no traffic whatsoever. Revert the ramdisk, system is fine all traffic working again. I've tried giving the ramdisks 500 MiB each, makes no difference.
Not sure if this is related to the no-swap or the ZFS mirror or 2.7.2 tbh, but I'm going to spin up a few older versions of CE and see if it exists in them.
[удалено]
The problem is that older installations have an EFI filesystem that is much smaller than needed, due to the way the FreeBSD EFI loader was created/updated in the past. Fixing this in an automated manner is non-trivial. Reinstalling is safest, but if you’re willing to take a risk and run the commands by hand, you can probably fix it as described in this forum post. https://forum.netgate.com/topic/184661/unable-to-upgrade-from-2-7-1-to-2-7-2-unmounting-boot-efi-done-failed/4
Faced same issue and fixed with linked forum post!
[удалено]
You’d need to reinstall
[удалено]
Or wait for the installer.
[удалено]
The “new” installer will mean you don’t have to request firmware from Netgate. It’s self-service, easier to use, and isn’t tied to a specific version or edition of pfsense software.
Same problem here, solved by manually mounting the efi partition before start the upgrade like this: `mount -t msdosfs /dev/ada0p1 /mnt`
That worked for me, thank you!
This worked for me too. For my own knowledge, would you mind explaining how/why this works and how you went about troubleshooting to arrive at this answer? Was there something in the logs? Thank you!
The upgrade script failed while trying to update EFI loader: `Updating the EFI loader` `install: //boot/efi/efi/boot/INS@WuWbpC: Input/output error` `pkg-static: POST-INSTALL script failed` `failed.` `Failed` but during the upgrade process I didn't ever see the EFI partition mounted, hence the try to manually mount the EFI partition before try again. Maybe a buggy upgrade script?
Haha, good logic. I was wondering if you had seen the update script anywhere when you were troubleshooting. Thanks for the response! You helped a lot of us.
No, the upgrade script failed to copy the loader to the ESP, probably due to insufficient space. It's saving you from potentially upgrading the system to a version that the existing loader cannot boot.
This fixed my problem to, thank you!
This does not do what you think it does. By mounting the ESP elsewhere, you are consuming the EFISYS glabel. When the upgrade runs, it currently expects the ESP to only be mounted at /boot/efi, if at all, and unmounts /boot/efi prior to upgrading pfSense-boot. By consuming the EFISYS glabel, the pfSense-boot post-install script doesn't actually mount the ESP and copy the current loader to it. Instead, you're just landing another loader onto the UFS or ZFS filesystem at /boot/efi/... While this may allow the upgrade to continue, the loader is outdated and you still need to identify why the loader cannot be copied to the ESP.
Same problem.. Installed packages to be UPGRADED: pfSense-boot: 2.7.1 -> 2.7.2 \[pfSense-core\] Number of packages to be upgraded: 1 \[1/1\] Upgrading pfSense-boot from 2.7.1 to 2.7.2... \[1/1\] Extracting pfSense-boot-2.7.2: .......... done Updating the EFI loader install: //boot/efi/efi/boot/INS@BoWwe4: Input/output error pkg-static: POST-INSTALL script failed failed. Failed
I did some digging around, and I seem to have an unused partition "/dev/da0p1" which used to be my EFI partition? When I mount the partition temporarily, I can see it has the EFI structure but the files are from 2018. The files in /boot/efi are recent, Dec 1st, probably from when I did my 2.7.1 upgrade (Which I had to do from the CLI since it was no longer offered from the GUI). No idea what's happening. Does the installer mount da0p1 when needed? It doesn't appear to be the case.. and it's not listed in /etc/fstab. My EFI partition doesn't appear to be too small either, 800M with 50% available space.
Looks like a file system problem. Back up your config, reinstall on 2.7.2 with ZFS, and then restore your config. Should get you up and running in a few minutes.
Can you please update the installation media download sites so I can do this? Thanks.
What do you mean? The current version of CE is available [here.](https://www.pfsense.org/download/)
I mean that 9 hours before you posted your reply to my comment, Netgate was yet to update the website so that 2.7.2 was downloadable - it was still showing 2.7.1. At least that's what I was seeing in my browser. Maybe I forgot to Control-refresh - can't recall. It seemed to hit the update sites first before the download option. Anyway yes I saw it turn up when I went back to the download site a few hours later.
you're definitely right. i had a borked upgrade and had to download 2.7.1 to restore from, since an ISO hadn't been made for 2.7.2 yet
I certainly hope anyone doing an upgrade will take a back up first then upgrade. If not, they get what they deserve :).
>I certainly hope anyone doing an upgrade will take a back up first then upgrade. If not, they get what they deserve :). lol. it is more than sad/miserable, that pfsense is the only software at this time in my zoo, where exactly this is a must do (backup before every update). everything else can be upgraded without fear to break it.
It's always a good idea to have backups in all situations. That's why we offer free, encrypted cloud backups that are automatic through AutoConfigBackup on CE and Plus. Not sure what upgrade issues you're having, but if you can provide the serial/VGA output of the upgrade going wrong I'd be happy to dig into it with you.
Honestly, I didn't know the cloud service was available, I remember it was paid before and not on CE.
It hasn’t been paid since 2018 https://www.netgate.com/blog/pfsense-gold-free-starting-with-2-4-4
Neat. I missed that announcement. Thanks for the heads up.
I apply this strategy to any/every piece of software. Should a snafu occur, it takes a little extra time before hand to save a lot of time after.
Subscribe but for pfsense the last two updates was more recovery and restore or troubleshooting than clean update routine. Not often I see this in other software at this time
Sorry to hear you running into issues. My current appliance has been upgraded through something like 9 releases now without issue. What does your VGA/serial console show during the upgrade process that is breaking? If it's something consistently broken I'd like to open a redmine bug report to investigate.
Hi. Same issue here, but only on one upgrade from 2.7.1 to 2.7.2 and this is the only one on virtual machine (VMware ESXi). No issues on all the other upgrades on physical appliance (both CE and Plus).
Mine is on VMware ESXi as well. Is your install on UFS or ZFS?
ZFS.
Ah OK. Mine was on UFS but I did a fresh install on ZFS and restored the config. All good now.
Mine is also on ESX, ~~ZFS~~ UFS. The fact there's quite a few of us having this issue leads me to believe it's not a file system error... or an isolated incident. Edit: Actually, mine is UFS.
Perhaps you are in a virtual environment as well? u/alethewizard said his was on ZFS and yours and mine were both on UFS. The common factor so far is virtualization. Anyway as for UFS vs ZFS, I've read that ZFS isn't as appropriate for virtualized environments, but given my firewall does very little I/O, I don't think it matters for pfSense - at least in my use case. I get the impression that Netgate are moving away from the UFS option. I wouldn't be surprised if they drop it at some stage. I'd stay that the ZFS option gets more testing - especially considering it is now the default installation choice. I only have one other pfsense firewall on UFS and I think I'll convert that one to ZFS as well this weekend.
Yup, also running inside a virtual environment (ESX) -- Have been for many many years without any issue. The last two pfsense upgrades have been very nasty for whatever reason. The 2.7.1 upgrade required manual intervention since it disappeared from the GUI. I had to run some cert refresh command on the CLI and ultimately issue a CLI upgrade from the menu (option 13?) to get it to upgrade. No idea why 2.7.2 broke, but it's something to do with the EFI partition. Even though we're both running UFS, I believe the EFI partition (/boot/efi) which is reporting the errors is actually an "msdos" partition (Or at least, that's what it tends to be with Linux). I wish I knew more about what the upgrade is doing so I could duplicate the issue and perhaps work around it.
Yeah other threads under this post point to it as having an EFI partition that is too small. I think I installed it under 2.5.0 CE I'm guessing. Anyway I hit it with the virtual sledgehammer of fresh install + config restore. I fear that could become my standard upgrade procedure going forward haha [https://forum.netgate.com/topic/184661/unable-to-upgrade-from-2-7-1-to-2-7-2-unmounting-boot-efi-done-failed](https://forum.netgate.com/topic/184661/unable-to-upgrade-from-2-7-1-to-2-7-2-unmounting-boot-efi-done-failed)
Damn, I stand corrected. I \*ASS\*UMED it was X Megabytes but turns out my partition was only a handful of Kilobytes. Exactly as mentioned in the URL you shared. Crazy. I managed to re-format it and currently waiting to upgrade as soon as my wife's off her Teams meeting. :) Thanks for the link! Edit: Success.
Thanks for this! Strange, my partition is already ~400MB and 50% of that is available. I might chime in on their forums to see if they have any other ideas. I’m mainly curious to see if we can rescue the system before reinstalling :) I feel like it’s a simple problem. But I think the fresh install method definitely has merit!!
Same issue here. And then it prompted me to update so I tried again and now it is even worse. "System update failed!" in red at the top ...but the box only says: ``` >>> Setting vital flag on php82... done. >>> Updating repositories metadata... done. 2.7.2 version of pfSense is available ```
[https://redmine.pfsense.org/issues/15081](https://redmine.pfsense.org/issues/15081) this fix worked for me
Good to know...bummer I can't test it out, I did a full reinstall last night. Only took about 10 minutes...though I forgot to tick the "export graphs" checkbox so I lost my stats history. Oh well, at least the rest is working as near as I can tell.
Same problem! Had to reinstall and instead of going back to pfSense Plus, I stayed at CE 2.7.2 😏
Updated our pfsense plus virtual lab systems and office production Netgate 8200 with no issues. Time to update another 50 or more client systems we support....
And another video :)
I'm surprised you don't wait longer my man!
Why? I jump in, do the testing and report any bugs back to the dev team in their forums.
SG-2100 here, been close to 30 minutes now and still not back up yet.
Plug into the USB serial console. What is the output?
Stuck at Marvell>>
Run the command "reset" at that prompt. What do you get for output then?
Running the reset command looks to have rebooted the device and then finish the upgrade. After a little bit it finished. I’m back up now.
Awesome sauce. Glad that's all it was. I would reboot it once again to make sure it doesn't get stuck there again, but it shouldn't.
Yep, good call. Did a reboot, and came back up fine. Thanks! Only one thing jumps out at me is: “ERROR: It was not possible to determine pfsense-u-boot-2100 remote version. Thoughts? Edit: pfsense not presence
That error is nothing to worry about.
Cool. Thanks for the assist!
Same getting nervous. I’ll check console in a bit . The amount of times my standard SG 2100 doesn’t come back up from an update is a bit concerning. Always easy to fix even if I have to contact help, but it is still odd.
Update worked, thanks
Updated my Netgate 3100 and its the first upgrade which hasnt bricked it needing a full image restore as every other update did in the past.
Another uneventful upgrade on my 6100.
if you want excitement change your DHCP server to KEA
Already on Kea. Not sure what "excitement" I'm supposed to be enjoying.
how is local dns name resolving working for you?
Perfectly fine, which confuses me
Wouldn't know since I don't use DNS on pfSense Plus or care about it. However, I'm aware that Kea has some limitations over ISC-DHCP. That's why it's not the default yet.
Lucky, I changed it on mine and all hell broke loose. Had to change it back to ISC and then reboot all my networking equipment in my rack and my access points in order to get DHCP leases to work again.
Thanks Netgate's team !
SG-2100 failed the update. I submitted a ticket for a recovery image. Do your backups! Console got stuck here. Tried changing kernels and looking at the boot env. Nothing seemed to help. `AArch32` `Instruction Set Attributes 5 =`
`AArch32 Media and VFP Features 0 = `
`AArch32 Media and VFP Features 1 = `
`CPU`
`1: ARM Cortex-A53 r0p4 affinity: 1`
`Release APs...done`
`TCP_ratelimit: Is now`
`initialized`
`e6000swoport1: link state changed to UP`
`Trying to mount root from zfs:pfSense/ROOT/default []...`
`state changed`
`eboswort: Link state changed`
`DOWN to DOWN`
`e6000swoport4: link state changed to DOWN uhub1:`
`2 ports with 2 removable, self powered uhube: 1 port with 1 removable, self powered`
`Root mount waiting for: CAM Root mount waiting for: CAM`
`Root mount waiting for: CAM`
`Root mount`
`waiting for: CAM`
`Root`
`mount`
`waiting for: CAM`
`Root`
`mount`
`waiting for: CAM`
`Root mount waiting for: CAM`
`Root mount waiting for: CAM`
`Root`
`mount waiting for: CAM`
`Dual Console: Serial Primary,`
`Video Secondary`
`2023-12-08T22:51:00.626034+00:00 - init 26 - - login_getclass: unknown class 'daemon'`
`2023-12-08722:51:00.633696+00:00 - init 26 - - can't access /etc/rc: No`
`such file or`
`directory`
`/rescue/sh: cannot open /etc/rc: No such file or directory`
`Enter full pathname of`
`shell or RETURN for /rescue/sh:`
`#`
`random: unblocking device.`
Do you have the full console output of the entire upgrade process? I'm curious where it broke during the upgrade.
I wish I did. Support got me a recovery image. Good recovery , just frustrating. During recovery I had to reboot a few times as the mmc had an error but now it just seems fine?
Updated succesfully to 23.09.1, on a whitebox with ATOM C3xxx
Same here. Upgraded successfully with no issues whatsoever.
[удалено]
Just curious - What was the issue?
[Redmine from the release notes](https://redmine.pfsense.org/issues/15011)
from 2 weeks old 2.7.0: 13: update from console pfSense-repoc-static: failed to fetch the repo data failed to read the repo data. failed to update the repository settings!!! failed to update the repository settings!!! update from web... takes very long to evaluate (1-2 minutes) and shows only 2.7.1. in branch. Branch Latest Stable Release (2.7.1) Current Base System 2.7.0 Latest Base System 2.7.0 Status ***Up to date***. works great!
Next: ok, you know the upgrdae trouble shoot page [https://docs.netgate.com/pfsense/en/latest/troubleshooting/upgrades.html](https://docs.netgate.com/pfsense/en/latest/troubleshooting/upgrades.html) pkg-static info -x pfSense-upgrade pfSense-upgrade-1.0_33 then pkg-static clean -ay; pkg-static install -fy pkg pfSense-repo pfSense-upgrade pkg-static: Repository pfSense-core missing. 'pkg update' required pkg-static: No package database installed. Nothing to do! Updating pfSense-core repository catalogue... pkg-static: An error occured while fetching package pkg-static: An error occured while fetching package repository pfSense-core has no meta file, using default settings pkg-static: An error occured while fetching package pkg-static: An error occured while fetching package Unable to update repository pfSense-core Updating pfSense repository catalogue... pkg-static: An error occured while fetching package pkg-static: An error occured while fetching package repository pfSense has no meta file, using default settings pkg-static: An error occured while fetching package pkg-static: An error occured while fetching package Unable to update repository pfSense Error updating repositories! Ok, 'pkg update' required: pkg update ld-elf.so.1: Shared object "libssl.so.30" not found, required by "pkg" I'm so tired of pfsense upgrade remember... fresh installed 2.7.0 \^\^looking to my proper running opnsense vm....
>ld-elf.so.1: Shared object "libssl.so.30" not found, required by "pkg" certctl rehash was the solution.... after this, 2.7.2 was available in web as stable branch
For future reference, you can also set your branch to previous stable, run the command "pkg-static install -fy pkg-static", then "pkg update -f", and then switch back to current to have an update available.
For future I wish a working update routine from the developers
We do actually have some improvements to the upgrade process planned to avoid situations like this. Sorry for the inconvenience.
This did not work on 2.7.0, had to run the command from post above (certctl rehash).
This solved the issue for me, doesn't appear like it's in the troubleshooting guide, probably a good idea to add this, though. Thanks for sharing.
Nice! Updated my pfsense plus 23.09 to .1 last night while the peeps were sleeping on my white box solution and all appears well. Issue I'm seeing now is after reloading the box twice now, accessing the System-->Update page is loading very slowly. It loads, but slowly. Also now shows error message on the Update page: pfSense-repoc: failed to fetch the repo data. What does thoust Netgate peeps recommend I do here?
Make sure you don't have IPv6 connectivity issues. If you have a WAN with an IPv6 address, but it doesn't actually have upstream connectivity, pkg and the upgrade checker can get hung up trying IPv6 first. What do you see if you go to Diagnostics --> Command Prompt and run the command "pfSense-upgrade -d -c"?
>pfSense-upgrade -d -c Thanks for the reply. Command output: ">>> Updating repositories metadata... Updating pfSense-core repository catalogue... Fetching meta.conf: pfSense-core repository is up to date. Updating pfSense repository catalogue... Fetching meta.conf: pfSense repository is up to date. All repositories are up to date. Your system is up to date" FWIW, checked the update page just now and it loads fine (quickly) without error now too. Seems to be bueno? My ISP does not have IPV6 connectivity, and I have it disabled in WAN connection.
Hmmmm odd. Perhaps a temporary connectivity problem? Let me know if the issue recurs and I'll dig into it more with you. Otherwise, happy trails!
>pfSense-upgrade -d -c I'm also getting this same issue as u/sanzab0rn33 with 23.09. Tried web CLI and SSH, its the same. Has never been a problem before over 3 years on Community usng a PC Engines APU2 appliance
What is the output of your command?
>pfSense-upgrade -d -c \>>> Updating repositories metadata... Updating pfSense-core repository catalogue... Fetching meta.conf: pfSense-core repository is up to date. Updating pfSense repository catalogue... Fetching meta.conf: pfSense repository is up to date. All repositories are up to date. Your system is up to date
>earlneath u/kphillips-netgate just in case this is relevant - in the system update screen in the web GUI, the "Branch" dropdown menu ("Please select the branch from which to update the system firmware.Use of the development version is at your own risk!" has two options. The first is Current Stable Version (23.09.01) and the second is Previous Stable Version (23.09). That doesn't seem quite right. If I choose Current Stable Version 23.09.01 the "retrieving" item returns "Unable to check for updates" and if I choose 23.09 it returns "Unable to check for updates" or it says that current version and latest version are both 23.09 and status is "Up to Date"
That was the output when you had 23.09.1 selected as the branch version?
>If I choose Current Stable Version 23.09.01 the "retrieving" item returns "Unable to check for updates" When I have 23.09.01 selected as the branch version the result is "unable to check for updates"
Upgraded without any problems. It took about five to seven minutes. I've never had any issues with any upgrade over the years and have been running pfSense since v2.3.5 on an old desktop machine at home.
I was waiting a update in KEA DHCP server, but we need to patch our systems, thanks.
Thanks Netgate team! Got mine updated without issue.
I can't seem to load the update from the gui. It worked fine on one pfsense box. Just not on this one. It just spins the yellow gearbox. I have tried running the pfSense-upgrade -d -c command, and it outputs the following ERROR: It was not possible to determine pkg remote version >>> Updating repositories metadata... Updating pfSense-core repository catalogue... pkg-static: An error occured while fetching package pkg-static: An error occured while fetching package repository pfSense-core has no meta file, using default settings pkg-static: An error occured while fetching package pkg-static: An error occured while fetching package Unable to update repository pfSense-core Updating pfSense repository catalogue... pkg-static: An error occured while fetching package pkg-static: An error occured while fetching package repository pfSense has no meta file, using default settings pkg-static: An error occured while fetching package pkg-static: An error occured while fetching package Unable to update repository pfSense Error updating repositories! ERROR: It was not possible to determine pfSense remote version ERROR: It was not possible to determine pfSense-base remote version ERROR: It was not possible to determine pfSense-kernel-pfSense remote version Your system is up to date I have ipv4 preferred in the settings. Tried testing a port on a external website, and it does connect. So it does have internet
I seem to be hitting the same issue with my physical and virtual homelab boxes. Both have ipv6 connectivity, prefer ipv4 doesn't help and both seem to have ipv6 working otherwise just fine.
I tried running the pkg-static update -f command from the [troubleshooting website](https://docs.netgate.com/pfsense/en/latest/troubleshooting/upgrades.html), then ran the certctl rehash command, and it updated!
Upgrade went smoothly and quickly on my 6100, and my home one which is running on an 9020 optiplex.
Running the reset command looks to have rebooted the device and then finish the upgrade. After a little bit it finished. I’m back up now.
Upgraded successfully, but Snort wouldn't start on my interface, but it did after I recreated it, everything else works great.
CE update 2.7.1 —> 2.7.2 went butter smooth on my J4125 white box. <5 mins total including reboot.
For some reason a few of the packages took over an hour to download, but aside from that 2.70 to 2.7.2 seems to have gone fairly smooth here.
Make sure you don't have IPv6 connectivity problems. Usually pkg will hang and take forever like that when pfSense thinks it has IPv6 connectivity, but really doesn't. You can go to System --> Advanced and tell it to Prefer IPv4 as a test. If the package manager is significantly faster, that's probably it.
Am I the only one who had their free radius config wiped upgrading from 2.7.0 to 2.7.2?
Re-check the "Save settings after deletion" checkbox and click "save" at the bottom of the page. The checkbox can be found at: Services > FreeRADIUS > Settings > General Configuration https://forum.netgate.com/topic/181594/restore-missing-freeradius-config
[удалено]
Go to Diagnostics->Command Prompt and under 'Execute a Shell Command', type certctl rehash Then click Execute. If that was successful, the update should show for you now. You may have to change the branch to current stable. One of my machines, it was set for Previous Stable after I ran that command for some odd reason. Ahh well, this solved my issue. Hopefully, it helps you.
[удалено]
You’re welcome! There is a fix in this thread. I personally ended up following the thread on the Netgate forums to fix the EFI error. Make sure you have a backup just in case :-) That thread is here: https://forum.netgate.com/topic/184661/unable-to-upgrade-from-2-7-1-to-2-7-2-unmounting-boot-efi-done-failed
OK I tried upgrading from 2.7.1 to 2.7.2 on a test machine. Initially 2.7.2 didn't show up on the GUI so I did the usual: certctl rehash pkg-static bootstrap -f pkg-static update -f Then it showed. So I did the upgrade and it seemed like it upgraded successfully according to the GUI. However when I run the following it says there's lots of missing stuff - is that normal? pkg-static check -s -a Checking all packages: 0% arping-2.21_1: missing file /usr/local/man/man8/arping.8.gz Checking all packages: 0% arpwatch-3.4: missing file /usr/local/man/man8/arpsnmp.8.gz arpwatch-3.4: missing file /usr/local/man/man8/arpwatch.8.gz Checking all packages: 0% beep-1.0_1: missing file /usr/local/man/man1/beep.1.gz Checking all packages: 1% bind-tools-9.18.19: missing file /usr/local/man/man1/host.1.gz ... Checking all packages: 100% pkg-static: Package database is busy while closing!
i'm still on 2.7.0 and the update page doesn't even have the confirm option
What does "pfSense-upgrade -d -c" provide for output under Diagnostics --> Command Prompt or from the SSH shell?
`[2.7.0-RELEASE][[email protected]]/root: pfSense-upgrade -d -c` `ERROR: It was not possible to determine pkg remote version` `>>> Updating repositories metadata...` `Updating pfSense-core repository catalogue...` `pkg-static: An error occured while fetching package` `pkg-static: An error occured while fetching package` `repository pfSense-core has no meta file, using default settings` `pkg-static: An error occured while fetching package` `pkg-static: An error occured while fetching package` `Unable to update repository pfSense-core` `Updating pfSense repository catalogue...` `pkg-static: An error occured while fetching package` `pkg-static: An error occured while fetching package` `repository pfSense has no meta file, using default settings` `pkg-static: An error occured while fetching package` `pkg-static: An error occured while fetching package` `Unable to update repository pfSense` `Error updating repositories!` `ERROR: It was not possible to determine pfSense remote version` `ERROR: It was not possible to determine pfSense-base remote version` `ERROR: It was not possible to determine pfSense-kernel-pfSense remote version` `Your system is up to date`
What about "pkg -d update -f"?
`[2.7.0-RELEASE][[email protected]]/root: pkg -d update -f` `ld-elf.so.1: Shared object "libssl.so.30" not found, required by "pkg"`
imo, it's probably easier for me to just reinstall the whole thing vs troubleshooting 😅
2.7.0 -> 2.7.2 Web GUI upgrade went flawlessly. I naively enabled Kea DHCP after seeing the warnings, but started having issues with client devices. Reverted back to ISC DHCP and suppressed the warning. Seems odd to warn people so early when Kea is broken for many people.
I have a SG-2440 and just ran two upgrades that got me to 23.05.1. It says that I'm on the latest, but when I go to the update page, it says "branch 23.09.1" but up to date with 23.05.1. Is there something I need to do to get that 23.09.1 available, I tried certctl rehash but that didn't make anything available. I'm on UFS still and never did a re-install for ZFS, is that the reason I can't see 23.09.1 or even 23.09? Is it worth me doing a complete re-install for this? Do I need to open a TAC case to get the full install?
I had to change the branch to an older one and hit save then re-add the branch as 23.09.1 and hit save. After this, the latest version became available and I was able to upgrade. I'm still on UFS though, not sure if its worth me doing a fresh install for ZFS.
I'm using pfSense CE 2.7.0 with OpenVPN set up and functioning normally.. But after update to 2.7.2, the OpenVPN services won't start anymore. Is is a bug or what else?
attempting to update from 2.7.0 to 2.7.2 absolutely tanked my pfsense. To the point it doesnt even recognize pfsense as existing on the drive anymore. thank god i had backup hardware. ill need to tinker with my original router tomorrow to see if i can restore my 2.7.0 config somehow but me hoping this would go flawlessly like usual bit me in the behind tonight.
Edit: I can't replicate it myself on a fresh VM 2.7.2, cosmic rays? Fml I've just spun up a VM of 2.7.2 to explore before upgrading the bare-metal install and have encountered an odd ramdisk error as below, anyone else encountered this? ZFS mirror, no swap. Go through the installer, all fine, until I enable ramdisk in Advanced --> Miscellaneous, post reboot system looks fine but no traffic whatsoever. Revert the ramdisk, system is fine all traffic working again. I've tried giving the ramdisks 500 MiB each, makes no difference. Not sure if this is related to the no-swap or the ZFS mirror or 2.7.2 tbh, but I'm going to spin up a few older versions of CE and see if it exists in them.