CARP and OSPF

andre.paiz

Hi everybody.
I´m studing to change my freebsd ipfw firewall for PFSense, but I have some questions.
Today my scenario is this:
One Freebsd server with 2 interfaces (WAN and LAN) with single IP each.
My ISP requires me to run OSPF, because all my IP´s are public. So I use Quagga on the FreeBSD machine.

I want to improve my environment and work with CARP by adding a second server. And here are my questions:

1 - Can I enable CARP only on the LAN interface (using 3 ips) and let each WAN interfaces do it´s job with the OSPF routers without a virtual IP (I have 2 IPs for the external connection) ? I think that if one host go down, the OSPF routers will be notified and everything will work fine :)
2 - Or should I request for a third IP and set CARP on both interfaces? Will quagga advertise my routes to my virtual IP? I guess that I will have to enable quagga on both servers, so I believe this is a problem.
3 - Whats the best scenario to use 2 redundant servers and OSPF?

Please someone help me with this. I need OSPF, but I also need redundancy of my firewalls.

Thanks
Andre

jimp

Edit /etc/rc.carpmaster and /etc/rc.carpbackup, have it disable OSPF when in backup state, start OSPF when it's in a master state

Like this patch does:
http://files.pfsense.org/jimp/patches/carp-quagga-stop.patch

andre.paiz

Hi.
Thanks for your answer.

I have configured just like that. And now, when one host is on the BACKUP state, QUAGGA is turned off.

I´ve noticed that both hosts form OSPF relationships with my ISP when they are running and that is correct.

I have one last issue now. When backup takes place, the ISP receives routes from it (all my routes are redistribute kernel metric 1 routes). That is confirmed based on the RouterID information. The problem is that my ISP receives routes from the Backup host, but the NextHop remains the MASTER IP, even knowing that it is turned off. Why is this happening?

I don´t run CARP on the external interface, because I only have 2 IPs. But PFSense performs some synchronization behind the scenes? I need my online host to be obviously the NEXTHOP for the advertised routes.

Thanks.

andre.paiz

Done! The problem wasn´t on quagga, but on the OSPF damon of a brocade switch core.

Thanks!

Derelict

This patch to rc.carpmaster and rc.carpbackup is still necessary on 2.1.4 to stop/start quagga on carp role change right?

It looks like some logic was added to determine whether or not to start quagga based on role at startup, but the patch is still required for failover.