In case anyone is interested, I have solved this problem.  Here's what the story was: There were 3 interfaces on the Ubuntu box: eth0 - Base NIC - No VLAN - No IP address configured eth0.2 - VLAN 2 - 192.168.124.21 eth0.3 - VLAN 3 - 192.168.125.21 The Avahi daemon (Bonjour) was sending the broadcast packets to all 3 protocols.  To my surprise, they were being sent out the base interface, despite the fact that it had no IP address. I solved the problem by creating new portgroups on the vSwitch which were dedicated to VLAN 2 and 3 respectively.  I then created new NICs in the Ubuntu VM to attach to each of these.  Now everything is working as expected.

All three networks are advertised on the same wire. In the end, I have two network drops that are both the same.  What I plan on doing is setting up two PFSense boxes to be in fail over mode.

Thanks for the note, I am very careful with how I secure/segregate the networks.

There isn't one yet, but we've looked at it before. If you are already familiar with BIRD, you can always install the FreeBSD package and configure it all by hand outside the GUI.

That's dependent on routing on the client OS. It's not easily done without routing all your traffic through the VPN. It's at least possible to route only RDP over the VPN with a BSD or Linux client by doing policy routing on the client's OS. It's not possible on Windows or OS X, at least not without some kind of third party policy routing software.

worked with madnote earlier today via commercial support to track down what was happening. In some circumstances where you have a lower-tier gateway with monitoring disabled and a higher tier with it enabled, the online status of the higher tier gateway is ignored. Work around in this circumstance was just enabling monitoring on all the gateways. Proper fix coming in 2.1. https://redmine.pfsense.org/issues/2910

Got it working :) i had an unused lan interface on my pfsense that had the same ip address as the wan gateway.

Thanks for the reply. I do have the nexthop configured appropriately so that it will use the CARP address. As our ISP won't allow multiple sessions, I'm not able to have 2 at once.  The main issue I'm trying to solve is to have all BGP session traffic originate from the VIP and not the physical interface as my ISP is only allowing 1 IP address to initiate the session.  If it won't use the VIP, then failover won't be possible. If the "listen on" doesn't do the trick, then I'll have to find some other way.  Maybe a static route will work. gary

seems like md5sig isn`t supported at this time http://forum.pfsense.org/index.php/topic,57760.msg308745.html#msg308745

As an alternative to avahi, I came across this free virtual appliance by Aerohive, aiming to solve this problem: http://aerohive.com/products/software-management/bonjour-gateway http://community.aerohive.com/aerohive/topics/how_do_you_install_free_virtual_bonjour_gateway

You can't assign a gateway group to a static route.  That's contrary to what a static route is; a specific route that network traffic must always follow.  Gateway groups or failover groups are adaptive routes that allow traffic to go through one or more alternate routes when a certain condition exists. You would need to remove your static routes if you want to use any kind of failover or redundancy.

Looks like it was captive portal. I added the IP's for the Vlan networks to the third tab on CP. I will test, mark as solved and add screen shots as it appears to be working now. [image: cp.png] [image: cp.png_thumb]

bump

@heper: assigning an interface to the openvpn services and creating a gateway group with different tiers might be a workaround I had a thought about that, but its not really a gateway - its just for 1 subnet, available via either tunnel (one being direct to the subnet, the other hopping over another part of the VPN ring). I'm surprised BSD doesn't support route metrics - it is a fundamental requirement :(

Yup, I missed that.  The drop-down menu covered it, but I also didn't think to look at the other radio button. The only thing left to look at are the WAN rules.  The gateways seem to be fine. Have you tried failing the ATT WAN connection and then verifying if you can get traffic out the TIMEWARNER interface?  Are you running any packages?

Ok, so upon further digging, it appears Bridging may be my answer. I will be trying this out shortly, and hopefully will be able to utilize VLANs with this.

@victorhooi: Hmm, that's fair enough - what's the best way of setting up VoIP traffic so it doesn't load balance, and other traffic so that it does? If you have a local PBX, match traffic from the PBX and assign it to a single WAN gateway, or a failover group. Use a rule at the top of the list, remember that first match wins. If you have local phones and a remote PBX, match traffic going to the PBX, do the same to it. So long as you have the rules in the right order it will do what you want. Oversimplified example: SIP traffic, use failover group everything else, use load balancing group

Here you have an example, is in Spanish…... is from a 2109WEB, Port 1 is the "Trunk port" (taged), ports 2 to 8 are the "Access ports" (untaged) http://forum.pfsense.org/index.php/topic,47388.msg249100.html#msg249100