diff --git a/CHANGELOG.md b/CHANGELOG.md
index c0c7e8b36..0eac09671 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -53,6 +53,7 @@ BUG FIXES:
   - core: Don't load Vagrantfile on `vagrant plugin` commands, allowing
     Vagrantfiles that use plugins to work. [GH-2388]
   - core: global flags are ignored past the "--" on the CLI. [GH-2491]
+  - core: provisoining will properly happen if `up` failed. [GH-2488]
   - guests/freebsd: Mounting NFS folders works. [GH-2400]
   - guests/freebsd: Uses `sh` by default for shell. [GH-2485]
   - guests/redhat: Down interface before messing up configuration file
diff --git a/lib/vagrant/action/builtin/provision.rb b/lib/vagrant/action/builtin/provision.rb
index ab0510503..bc92b8dd5 100644
--- a/lib/vagrant/action/builtin/provision.rb
+++ b/lib/vagrant/action/builtin/provision.rb
@@ -28,17 +28,14 @@ module Vagrant
           # Check if we already provisioned, and if so, disable the rest
           ignore_sentinel = true
           ignore_sentinel = env[:provision_ignore_sentinel] if env.has_key?(:provision_ignore_sentinel)
+          sentinel_path = nil
+
           if !ignore_sentinel
             @logger.info("Checking provisioner sentinel if we should run...")
-            sentinel = env[:machine].data_dir.join("action_provision")
-            if sentinel.file?
+            sentinel_path = env[:machine].data_dir.join("action_provision")
+            if sentinel_path.file?
               @logger.info("Sentinel found! Not provisioning.")
               enabled = false
-            else
-              @logger.info("Sentinel not found.")
-              sentinel.open("w") do |f|
-                f.write(Time.now.to_i.to_s)
-              end
             end
           end
 
@@ -58,6 +55,14 @@ module Vagrant
           # Continue, we need the VM to be booted.
           @app.call(env)
 
+          # Write the sentinel if we have to
+          if sentinel_path && !sentinel_path.file?
+            @logger.info("Writing provisioning sentinel so we don't provision again")
+            sentinel_path.open("w") do |f|
+              f.write(Time.now.to_i.to_s)
+            end
+          end
+
           # Actually provision if we enabled it
           if enabled
             type_map = provisioner_type_map(env)