[solved]
The problem strangely solved by re-configuring System -> Routing values.
Also I changed the default gw to Automatic (I doubt if this has been effective!)

It would probably be easier to take a backup of the primary, replace opt9 with opt8 in a copy of the backup, then restore the edited version.

You do not need outbound NAT on LAN at all. That is just silly.

You should be able to ping both interface addresses and the CARP VIP of the connected subnet if the rules on that interface allow it.

If you can ping the interface addresses but not the CARP VIP, check the ARP table of the device you are testing from to be sure it has all three ARP entries. The interface addresses should have the interface MAC address. The CARP VIP should have the CARP MAC.

If that is all in place, be sure the switch connecting everything has the CARP MAC in its MAC address table. It should be on the switch port that is currently connected to the CARP MASTER node.

@derelict Sorry because my HA interface is a VLAN I forgot to added into the switch

That was the problem

Thank you

Well, you can add another switch between pfSense and the other switches....

@netblues : Thank you again - that's cleared up the IP address confusion (and yes I had read in the book that auto-nat wasn't supported with CARP - forgot that in the confusion with PPPoE).

Our usual networking hardware supplier recommended NETGEAR DM200-100EUS ADSL/VDSL Modem to replace the ISP supplied router. Reading the manual shows it appears to have routing features. Does this qualify it as a "router device" even though it's being called a "modem"? The constant interchangeability of the two terms is driving me nuts. Once I've nailed down what actual type of device I need, I can order one and start an actual experiment.

Appreciate your replies very much - thank you for your time and patience

Great answer. That is what I was looking for : a limited privilege account.
I will try this soon.

Best Regards (and Merry Xmas to all)

also the Book:
https://www.netgate.com/docs/pfsense/book/highavailability/index.html

If you do - don't use .1 or .254 since those are common default IPs ;)

Pretty much the reason pfsense IP on all its vlans is .253...

You cannot use Proxy ARP for IPv6 because IPv6 does not use ARP.

You'll have to use IP Alias.

Any IPv6 on inside interfaces should be provisioned using an interface network and a routed prefix to you. Like a /48, /56 or /60.

It sounds like you are trying to shoehorn a VPS service designed to run something like a cPanel or Plesk system into use with a router.

You're going to meet with undesirable results in all likelihood.

No. LADVD is something entirely different.

I think I may have found the issue. Both device their selves were in the NAT range tied to the single VIP. I believe the secondary box was communicating out, but any reply went back to the primary box. I found a NAT setting to map "This Firewall" to it's WAN interface address and not the VIP. That seems to have worked on both devices.

I did have our upstream provider NAT all to the same public IP:
VIP x.x.x.1
Device 1 x.x.x.2
Device 2 x.x.x.3

Thank you all for the help!

what is your point ?
my carp setup does work. i have multiple machines in each vlan. no problem there. i can shutdown either firewall and unplug any cable without producing a mess. i had disabled pfsync in some previous tests which is why using the carp address as the gateway is required.

am i expected to configure a LAN interface as the first interface and use the LAN address as the failover peer for each of the dhcp server instances ? this would be meaningful indeed. but in that case, it may be worth to drop a line in the documentation and there is little to no point in setting the same address for each dhcp instance.

@netblues Yeah you were on the money.

Bound the OpenVPN client service to the CARP WAN VIP and failover/failback operates perfectly - as does all everything else.

Perfect, thank you :) (better check my settings more thoroughly next time ;) )

I just updated my test vms to 2.4.4-RELEASE-p1 and from what I can tell the issue has been fixed! I now get the client-hostname on the master and the backup

Hi jimp,

Thanks for this. This stopped me making a big mistake (not adding new switches to the purchase list) and potentially wasting hours trying to work out why CARP wasn't working. It will also save me the hassle of arranging with Virgin for an upgrade we don't need.

I do actually now remember reading in the pfsense book that the switches must be checked for multicast support. However, the text didn't properly register until your reply.

Thanks again for your help and patience.

@everyonelovescheese :
Thanks for updating the thread with your final outcome i.e. getting new IPs. It helped me by closing the subject down at my end as not currently viable and allowing me to move on.

Thanks, this was the trick!

i've solved the problem. its very similar to bridge behavior i encountered in another installation. I only have vlans defined for my LAGG. once i created another interface that would be untagged on the LAGG, it picked up my native vlan as expected. all of the VIPs for the tagged interfaces started working.

so just for my own curiosity i deleted the native interface i crated and rebooted. everything still works. all in all i must have just jiggled the handle