Upgrading to pfSense 2.7.1 | pfSense+ 23.09 - What you need to know before the upgrade!

🔥 Welcome to our comprehensive guide on upgrading your pfSense firewall to version 2.7.1 and pfSense+! to 23.09 🔥
In this video, we dive deep into the process of upgrading your pfSense system to the latest version, 2.7.1 and pfSense+ to 23.09. We cover everything from the essential preparations to the step-by-step upgrade process, and we'll also discuss the potential pitfalls and what might break during the upgrade. Perfect for IT professionals and network enthusiasts alike!
=== SUPPORT OUR CHANNEL ===
Support our channel by joining our KZbin channel membership to donate a small amount each month. Not only does your support help us continue creating content you love, but as a channel member, you'll also enjoy early access to our videos. While our videos are scheduled for regular days and times, becoming a channel member allows you to watch them as soon as they are uploaded. Your support truly makes all the difference!
Channel Membership:
👍 www.youtube.co...
Patreon:
💳 go.sheridan.uk...
=== GET IN TOUCH ===
📣 Hire Us: Hire us for a Project
go.sheridan.uk...
📣 Forums: Discussion on Videos
go.sheridan.uk...
📣 Facebook: Follow Us on Facebook
go.sheridan.uk/fb
📣 LinkedIn: Connect with us on LinkedIn
go.sheridan.uk...
📣 Twitter: Get in touch on X (Twitter)
go.sheridan.uk/x
📣 Website: Our Website
sheridancomput...
===
=== AFFILIATES & REFERRALS ===
This video is NOT sponsored. Some product links are affiliate links which means if you buy something we'll receive a small commission.
Sheridan Computers Swag Store on Amazon:
go.sheridan.uk...
🛍️ Amazon Affiliate Store: Products We Use
go.sheridan.uk...
AUDIO AND VIDEO
🎧 AE Juice: animation tools, plugins and presets
go.sheridan.uk...
CLOUD HOSTING, SERVERS AND STORAGE
☁️ Digital Ocean: VPS & Storage
go.sheridan.uk...
☁️ HostiFi: Cloud UniFi Controllers
go.sheridan.uk...
☁️ Vultr: VPS & Storage
go.sheridan.uk...
===
If you'd like to hire us, please head over to our website and fill out the contact form.
If you found this video useful please hit the like button and consider subscribing to our channel.
Website:
sheridancomput...

[@RoboNuggie]

This will come in handy, thank you Sam....

[@patrickgoggins7539]

Upgrade broke a rather new 23.05 install. Wiped and converted to OpnSense, tired of the Netgate BS. Going through the painful process of rebuilding the various installs I have over to OpnSense.

[@davidpriestley1650]

I would have thought that changing the available ciphers should be more than a minor point release - which is usually bug fixes. Surely they would have known the EOL on openssl 1.1 for a while now and could have included it in the 2.7.0 major update.

[@sheridans]

This was the same feelings I had tbh

[@rpsmith]

I've upgraded several CE and Plus boxes and have had about 50% success! The ones that failed seem to be confused about what version they were now on and had various service failures. Also, stay the hell away from the new DHCP service! It Sucks! I'm now only doing upgrades by fresh installing and restoring the former config. This release in a total crap shoot to online upgrade!

[@sheridans]

There's definitely issues, the kea dhcp says has basic functionality in the blog post. I didn't realise 2.7.1 CE was actually out because when i downloaded what stated was 2.7.0 from the website it was 2.7.1.

[@magesnz]

I have pfsense plus 23.05 but i don’t know if i should upgrade because i have the home lab edition so im wondering if i need to downgrade to ce edition

[@sheridans]

Atm it still upgrades, so you're good to do it. At some point in the future they plan to prevent it. Just upgrade the plus for know, reinstall when it comes to it

[@rpsmith]

@@magesnz -- I wouldn't try upgrading online as it's likely to fail or some features may be flaky! Also, I switched all my Plus boxes back to CE as I find I can get along just fine without the extra features and I don't have to open a trouble ticket to get the latest CE firmware images.

[@sheridans]

The only advantage of plus in all fairness, is boot environments, which don't work on CE as the upgrade script deletes them. Boot environments are part of the freebsd core operating system, not something that should be charged for, or screwed with if you don't pay the license. I'm still trying to figure out how to do boot environments from command line, but upgrades download a new upgrade script which wipes shit out.

[@Mr_Meowingtons]

2.7.1 did not last long till they came out with 2.7.2 seems a month or 2 after.

[@TylerB_777]

Hows it going? Thanks for the video! I have a few clients running pfsense in remote locations and my only connection to them is through openvpn. If I am utilizing an older cipher or an older setting how would I recover from it? Would you make a fresh openvpn server before upgrading using an acceptable cipher? Also can I fix the CA and web cert before upgrading? How would I do that? If you know the answer to any of this it would be really helpful for me. Ive moved about 1500 miles away from my installs and id like not to have to coordinate with a remote tech. Obviously I will if things break.

[@sheridans]

Probably creating a second vpn server on your router (you can have more than 1) with new CA. You'll need to recreate user certs also if they are using sha1 You can always use a remote access tool (such as screenconnect which is free for a single user) to configure the VPN

[@TylerB_777]

@@sheridans Right, I think that's my best bet as well, creating another open on server. I also run a ScreenConnect server so that's an option. I'm sort of on high alert because the last update I ran on a remote pfsense was on a SG-1100. I guess the boot partition wasn't big enough and I had to reload the OS. That was about 6 months ago. Just a few days ago I updated my own SG-1100 to 23.09 and somehow my zfs boot environments didn't take hold. The system didn't boot back up and when I took a look via console it said my config.xml was corrupted... I was up until 3 am on a Sunday night because I figured why not just hit update real quick 🤣😭.

[@rpsmith]

@@TylerB_777 -- I had one SG-1100 that successfully updated to 23.09 (it took about 20+ minutes to come back online) and one that I had to reload. I have Remote Utilities installed on at least one computer with a second USB NIC available at all my remote sites (RU gives you 10 free licenses for any use) and if I have to reload a firewall I can have a remote person connect that PC directly to the ISP and reload the firewall with that machine. Also, I would suggest you setup a backup IPsec and a WireGuard tunnel on all you remote firewalls.