Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Failover split brain effect

    Scheduled Pinned Locked Moved HA/CARP/VIPs
    1 Posts 1 Posters 937 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • G Offline
      Groets
      last edited by

      Hi Guys,

      I need some help for a strange behavior with 2 firewall in failover mode.

      Config

      • PfSense 2.1.3-Release
      • FreeBSD 8.3
      • running into 2 VMs with vSphere 5.1

      Firewall 1 (default master)
      WAN1 : 91.xxx.xxx.1
      WAN2 : 46.xxx.xxx.1

      Firewall 2 (default backup)
      WAN1 : 91.xxx.xxx.2
      WAN2 : 46.xxx.xxx.2

      CARP VIP
      WAN1 : 91.xxx.xxx.3
      WAN2 : 46.xxx.xxx.3

      Step 1 : Shutdown Firewall 1

      The firewall 2 becomes the master. Perfect !
      But i see this king of logs for the firewall 2 :

      Block - WAN1 - 46.xxx.xxx.2 - 224.0.0.18: VRRPv2, advertisement, vrid 15…
      Block - WAN1 - 46.xxx.xxx.2 - 224.0.0.18: VRRPv2, advertisement, vrid 16...
      Block - WAN1 - 46.xxx.xxx.2 - 224.0.0.18: VRRPv2, advertisement, vrid 13...
      ...

      Step 2 : Restarting Firewall 1

      Firewall 1 and 2 are both in master mode and all connections are very slow (split brain ?)

      Firewall 1 logs :
      Block - WAN1 - 46.xxx.xxx.1 - 224.0.0.18: VRRPv2, advertisement, vrid 23…
      Block - WAN1 - 46.xxx.xxx.1 - 224.0.0.18: VRRPv2, advertisement, vrid 22...
      Block - WAN2 - 91.xxx.xxx.1 - 224.0.0.18: VRRPv2, advertisement, vrid 6...
      Block - WAN2 - 91.xxx.xxx.1 - 224.0.0.18: VRRPv2, advertisement, vrid 8...
      ...

      Firewall 2 logs :
      Block - WAN1 - 46.xxx.xxx.2 - 224.0.0.18: VRRPv2, advertisement, vrid 23…
      Block - WAN1 - 46.xxx.xxx.2 - 224.0.0.18: VRRPv2, advertisement, vrid 22...
      ...

      I'm surprised to see WAN1 with an IP 46.xxx.xxx.x instead of 91.xxx.xxx.x (and vice versa for WAN2)

      If i click on the red cross icon, i see the following message :
      @36 block drop in log quick proto carp from (self:37) to any

      Perhaps unrelated with the problem but a notification (into the header) appears with the following message :
      There were error(s) loading the rules pfctl: DIOCADDRULE: Device busy - The line in question reads [0]

      Step 3 : Rebooting Firewall 2
      Firewall 1 stays master and Firewall 2 come back to Backup. Perfect !

      Thanks for your support !

      1 Reply Last reply Reply Quote 0
      • First post
        Last post
      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.