Testing High Availability

mgiammarco

I have the same problem in one installation.
Remember that pfsync must also work to transfer tcp states.
Gui is misleading because in master you should enable xmlrpc sync AND pfsync.
In slave you never enable xmlrpc sync but you must enable pfsync!
Mario

rafel.amer

Hi!

I have State Synchronization Settings (pfsync) in both firewalls, primary and secondary,
and XMLRPC Sync only in the primary.

But, the connections are not maintained when I Enter Persistent CARP
Maintenance Mode in the primary node.

Derelict

Look at Diagnostics > States. See what is actually happening. Post them from both nodes.

mgiammarco

Hello,
I have the same problem and I have done the same things. In diagnostics states there are so many states and they are different in each firewall.

Derelict

Filter them on what you are interested in.

rafel.amer

In my system, the Diagnostics -> States are the same in the primary and secondary firewalls (with very few differences).

mgiammarco

I have checked states too and I see in slave the same states of master.
I exclude other problems because I can do this test:

start a tcp connection on master, disable master, tcp connection does not work, reenable master and tcp starts exchanging packets again;
exchange master with slave, do the same test, I obtain the same result.

So master and slave have the same behaviour and the same configuration.
I have other pfsense installations with ha and only in this one I have this problem.

Thanks again,
Mario

Derelict

Post the states. Detail which address is which (interface, CARP, etc)

mgiammarco

On master I have:

VDSL200 udp yyy.183.73.74:53634 (192.168.0.4:5060) -> xxx.97.59.76:5060 MULTIPLE:MULTIPLE 13.985 K / 32.303 K 8.46 MiB / 9.34 MiB

on slave:

vdsl200 udp yyy.183.73.74:53634 (192.168.0.4:5060) -> xxx.97.59.76:5060 MULTIPLE:MULTIPLE 34 / 50 23KiB/18KiB

In this case I used a voip call that is udp (so it should not have states). The voip call "stays" on master.

I forgot to say an important thing: icmp "works". I mean if I ping from inside to 8.8.8.8 and I put down master ping packets continue to flow.

Mario

Derelict

Is yyy.183.73.74 the CARP VIP?

Is 192.168.0.4 set to use the CARP VIP on the firewall on that interface as its default gateway?

mgiammarco

Yes yyy.183.73.74 is the public ip carp vip. Nat is on that ip.
Private subnet carp ip is 192.168.0.254. Yes dhcp gives 192.168.0.254 as gateway to computers.

I explain again tests I have done (please rafel do these tests too):

ping from an internal pc (e.g. 192.168.0.55) to 8.8.8.8. Ping works. Fence master. Slave becomes master. Ping continue to work! It means that nat/dhcp/carp/… is all ok, right?
telnet from 192.168.0.55 to internet server xx.yy.aa.bb. Telnet works. Fence master. Slave becomes master. Telnet stops working!!!

After test 2) someone can say me: in your setup obviously master configuration is different from slave. Perhaps some firewall settings.
OK! so I exchange master with slave and I do again test 2. I obtain the same result!

How can I debug it?
Is there someone that with 2.4.1 has HA working?
Thanks,
Mario

Derelict

Yes. Me.

I have tried to duplicate several of these reports and the only case I can find where there might be a problem is described here:

https://redmine.pfsense.org/issues/8100