I found a workaround which is not ideal but allows me to move on.
I noticed that in fact i couldn't ping the LAN VIP if i was connected in WiFi to the active CARP appliance.
So basically instead of having two active hotspots, I just had to make sure the hotspot was disabled on the active CARP appliance.
To do so here is what I did:
1 - Modify /etc/devd.conf to point to custom rc.carp scripts
...
# CARP notify hooks. This will call carpup/carpdown with the
# interface (carp0, carp1) as the first parameter.
notify 100 {
match "system" "IFNET";
match "type" "LINK_UP";
match "subsystem" "[a-zA-Z0-9_]+_vip[0-9]+";
action "/etc/rc.carpmaster.custom $subsystem";
};
notify 100 {
match "system" "IFNET";
match "type" "LINK_DOWN";
match "subsystem" "[a-zA-Z0-9_]+_vip[0-9]+";
action "/etc/rc.carpbackup.custom $subsystem";
};
...
2 - Create /etc/rc.carpmaster.custom
#!/bin/sh
/etc/rc.carpmaster $1
ifconfig ath0_wlan0 down
/usr/local/sbin/pfSsh.php playback svc restart racoon
3 - Create /etc/rc.carpbackup.custom
#!/bin/sh
/etc/rc.carpbackup $1
ifconfig ath0_wlan0 up
So basically, when an appliance becomes master:
It runs the usual carp scripts
It disables the hotspot
It restarts racoon (to make sure IPSEC connection are restarted)
when an appliance becomes master:
It runs the usual carp scripts
It enables the hotspot
Having the same SSID and both appliance not too far from one another makes it almost transparent to end-users (about 30 seconds service interruption in case of a CARP failover).
