Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    pfSense HA LAN Interfaces Only

    HA/CARP/VIPs
    2
    91
    16.1k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • V
      viragomann @CloudNode
      last edited by

      @iptvcld said in pfSense HA LAN Interfaces Only:

      Question; I was able to get sync to work via the LAN interface - but I am reading this is not a good idea.

      Since you don’t need to sync states, but only the configuration, it‘s ok to do it on the LAN.

      2nd Question; with HA sync turned on i found i was getting all sorts of duplicate IP overlappings as both routers were on at the same time and i assume LAN was causing issues as both were in sync and both connected to my unifi switch. How do i make this work so that the main/master is only serving the network while my VM is on backup for LAN only.

      Disconnect the interfaces from the VM except the sync interface.
      If you use LAN for sync you have to set the backup to another IP till you switch over.

      C 1 Reply Last reply Reply Quote 0
      • C
        CloudNode @viragomann
        last edited by

        @viragomann So y other thought was to not connect the LAN interface cable to the VM until i ever need to and at that point I would swing over LAN and WAN..

        But; i was wondering since I have a SYNC interface now (ordered the extra LAN cards) that I want to keep my LAN active in Master/Backup mode. Do I need to set CARP on the LAN interface for that to work and then change my DHCP gateway to the CARP VIP IP and the failover peer IP to the VM interface IP? Will this work?

        As noted in my post i have 3 VLANS (IOT, NOT, CAM) all using the LAN interface, would I need to create CARP VIP's for those as well or just the main LAN?

        1 Reply Last reply Reply Quote 0
        • C
          CloudNode
          last edited by

          I am also reading that my LAN interface and any VLAN interfaces have need to have 3 IP's assigned

          Main: x.x.x.2 - VM: x.x.x.3 and CARP VIP x.x.x.1 and i need to do this for all my VLAN interfaces?

          Issue with this is that I already have a heavy sever unit using x.x.x.3 and alot of item use that; what would i do in this case?

          Thanks,

          V 1 Reply Last reply Reply Quote 0
          • V
            viragomann @CloudNode
            last edited by

            @iptvcld
            If you set up CARP, there would be no need to disconnect or change the IP to switch over to the backup.
            In this case you need to configure a CARP VIP for all used interfaces, for LAN and all VLAN.

            I am also reading that my LAN interface and any VLAN interfaces have need to have 3 IP's assigned
            Main: x.x.x.2 - VM: x.x.x.3 and CARP VIP x.x.x.1 and i need to do this for all my VLAN interfaces?

            When you set up CARP, change all existing interface IPs to another one and set the CARP IP to that ones you used till now, since these have to be the gateways in your subnet. So you don't need to change the interface settings on the devices behind.

            The real interface IPs can be any in the subnet. You can set them to whatever is not in used like .251 and .252.

            C 1 Reply Last reply Reply Quote 0
            • C
              CloudNode @viragomann
              last edited by

              @viragomann Thank you very much for the help; I am going to implement this today and will paste a screenshot and hopefully you will be able to let me know if i did it correct as a check point for me.

              Question.. Outbound NAT Rule, i have been reading this needs to be updated as well - is this the case only if i was doing CARP for my WAN? In my case I am not going to have WAN connected in my failover router and will be swinging it over when in need.

              V 1 Reply Last reply Reply Quote 0
              • V
                viragomann @CloudNode
                last edited by

                @iptvcld said in pfSense HA LAN Interfaces Only:

                Question.. Outbound NAT Rule, i have been reading this needs to be updated as well - is this the case only if i was doing CARP for my WAN? In my case I am not going to have WAN connected in my failover router and will be swinging it over when in need.

                Exactly, it is not needed when you don't configure the WAN as CARP. As you stated above, you want to do a manual failover by pulling the WAN cable from the primary router and connect it to the secondary. So there is no need for CARP VIP.

                C 1 Reply Last reply Reply Quote 0
                • C
                  CloudNode @viragomann
                  last edited by

                  @viragomann Thanks again, I am setting up my interfaces on the 2nd failover pf and since i have LAGG on my LAN (master pf) - i am trying to setup LAGG on my LAN on the failover but i just have the 1 card for lan on the failover. I was able to create a LAGG 1 the single card but what protocol would i use? I cannot do LACP because then my switch will need a group of 2 ports (min) - I am thinking Load Bal but i am not too sure.

                  Thank you!

                  V 1 Reply Last reply Reply Quote 0
                  • C
                    CloudNode
                    last edited by

                    I just swinged my WAN over and i getting this error
                    ebecdda1-d968-4fbb-955c-c4486656b3f0-image.png

                    The link does not go up and i have verified the pppoe username and password that its the same on my master pf

                    V 1 Reply Last reply Reply Quote 0
                    • V
                      viragomann @CloudNode
                      last edited by

                      @iptvcld
                      I would try FAILOVER. I think this should work with only one network port.

                      C 1 Reply Last reply Reply Quote 0
                      • V
                        viragomann @CloudNode
                        last edited by

                        @iptvcld
                        Any reason for using the Broadcom NIC? Do you passthrough the hardware?
                        If it's virtual set it to Intel E1000.

                        C 1 Reply Last reply Reply Quote 0
                        • C
                          CloudNode @viragomann
                          last edited by

                          @viragomann Thanks; i have selected failover and for the primary i changed it from Auto to my nic interface i will have my wan in. (even thought its a single card LAGG)

                          1 Reply Last reply Reply Quote 0
                          • C
                            CloudNode @viragomann
                            last edited by

                            @viragomann Its a physical card pass-though on unraid but i think i figured out what the issue is That port may be defected on the card. Other port works ok . But now i need to find a different card as i needed both ports..

                            1 Reply Last reply Reply Quote 0
                            • C
                              CloudNode
                              last edited by

                              Alright card issue has been fixed..

                              Question; i noticed my non CARP Virtual IP's from master are not being synced over to failover.. Is this normal? Only when i create a CARP VIP, that is when it gets copied over. Thanks,

                              V 1 Reply Last reply Reply Quote 0
                              • V
                                viragomann @CloudNode
                                last edited by

                                @iptvcld
                                Yes, interface settings cannot be synced. If they were, you would have the same IPs on master and backup, which wouldn’t work naturally.

                                C 1 Reply Last reply Reply Quote 0
                                • C
                                  CloudNode @viragomann
                                  last edited by

                                  @viragomann thank you and that makes sense!

                                  I am also finding that when i switch the master CARP to my failover that some devices i am no longer able to reach unless i reboot the device once whole on the master pf and then if i were hot it from the failover, that will work. Seems to be a one time thing per device though.. Maybe an option i am missing?

                                  V 1 Reply Last reply Reply Quote 0
                                  • V
                                    viragomann @CloudNode
                                    last edited by viragomann

                                    @iptvcld
                                    A reboot should not be really necessary. But existing connections will timeout though, because the connection is on the other node and you don't sync states.

                                    C 1 Reply Last reply Reply Quote 0
                                    • C
                                      CloudNode @viragomann
                                      last edited by

                                      @viragomann Thanks.. Does the High Availability Sync setting under System needs to also be turned on for the slave? I currently only have it configured and on the master and settings seem to be syncing fine. I just have been reading that on the slave you also need to enable with a check and select tje interface and pfsync Synchronize Peer IP only; dont touch the bottom portion and save. Is this true? and if so, how is sync working right now then?

                                      Thank you!

                                      V 1 Reply Last reply Reply Quote 0
                                      • V
                                        viragomann @CloudNode
                                        last edited by

                                        @iptvcld
                                        No, this is only needed for syncing states in both directions. But syncing states doesn't make sense in your case, cause your WAN has no CARP VIP.
                                        So you can only sync settings and this is done from the master to the slave.

                                        C 1 Reply Last reply Reply Quote 0
                                        • C
                                          CloudNode @viragomann
                                          last edited by

                                          @viragomann I am also syncing LAN interfaces as per below:
                                          d57115b6-486c-45c8-abd8-3adb0f5b8509-image.png
                                          8c1a42fb-f638-4040-925e-a261b02cd9d7-image.png

                                          V 1 Reply Last reply Reply Quote 0
                                          • V
                                            viragomann @CloudNode
                                            last edited by

                                            @iptvcld
                                            Yeah, you can sync states if you want, but only connections passing CARP interfaces solely will benefit from it. Connections passing the WAN will stuck after failover anyway.
                                            If states sync is on pfSense will also try to sync WAN states, of course. Don't know what happens on the other box, when the interface is not present.

                                            For syncing states it's recommended to use a separate sync interface.

                                            C 4 Replies Last reply Reply Quote 0
                                            • First post
                                              Last post