You are right - it was my own issue. I hadn't taken an old test system offline. It was not working properly and only connected to the network intermittently causing the issue. I hate it when people don't post their answers to problems so even though I'm "late" I'm hoping that's better than "never". Thanks again! m

I believe the issue may be due to interrupts. From watching top (top -P CC), I see that the interrupts are only hitting one CPU. Is there a way to balance that load across both CPU's? last pid: 79130;  load averages:  0.33,  0.22,  0.15                                                            up 85+19:36:44  13:05:01 38 processes:  1 running, 37 sleeping CPU 0:  0.0% user,  0.0% nice,  0.0% system, 54.3% interrupt, 45.7% idle CPU 1:  0.0% user,  0.0% nice,  1.1% system,  0.0% interrupt, 98.9% idle Mem: 84M Active, 32M Inact, 281M Wired, 1336K Cache, 91M Buf, 3524M Free

If your status is correct, all master on the primary, all backup on the secondary, and you're hitting the secondary when going to the CARP IP, that's a problem with your switch(es) on that interface. They're sending the CARP MAC to the wrong device. The advertisements from the master system update switch CAM tables so things go to the correct port, and that's not being handled properly on your switch for some reason.

yes, that's what I meant. Thanks,

Thanks again to jimp for putting me on the right path.  :D

that did it!  Thank you very much for the help!

Thus when the "master" is down, ether don't do any change to slave, or if there is change to slave, we have to manually update the master when it is up I guess? I tried to do the "bold" but it gave error on the "slave" immediately saying something like it does find the target as a valid sync device.

No suggestions? It cant be network traffic on Sync interface since its a direct connect. Not sure where to look and how to fix this. What the correct procedure to swing  the interface back to primary? Last time I just rebooted the secondary but it seems a bit crude.

I created another vlan (12) today, and have the exact same issue. I can ping the backup-carp ip, but not that master nor the virtual. The firewall rules are empty, so nothing should be allowed. Any help or ideas are very welcome!

That's still a bit vague as to what they actually meant. They might have meant that you should have multiple ISPs not just that one, so that you could have some redundancy in case it fails. To say more you'll need to have them clarify the original statement.

No.

@cmb: only if it's the only remaining IP alias in that subnet. See comments on the bug ticket you linked. You have to have an IP assigned to an interface within the subnet of CARP. Can we make it so it is not like this? Is seems unreasonable. I deleted the CARP IP and the VIP then recreated the CARP IP. Why can't I do this in just one step? I would end up in the same place. At the moment creating an additional IP is a one-way operation, that I can't easily reverse. It's miserable.

I forgot to add: for those extra three IPs I don't have to have CARP. They will be used for non-essential operations. Does that make it easier?

Plz detail your network configuration.  Maybe there is a clue there.