HA strange behaviour, problems on passive box

[viragomann]

@viniciusbr
Don't disable CARP on PF1, just activate the "persistent maintenance mode".

[ViniciusBr]

@viragomann

The way you suggested:

PF1 went to backup status as expected and PF2 as master as expected.

NOTES:

• PF1 as master I sill cannot ping PF1 IP from DMZ;
• PF2 as master DMZ is gone, can only ping PF1 IP, VIP and PF2 IP does not work;

PF1 logs:

PF2 logs:

[viragomann]

@viniciusbr
Just to be sure, is the promiscuous mode enabled on ESXi?

[ViniciusBr]

@viragomann

Yes:

PF1:

PF2:

[viragomann]

@viniciusbr
Check out the ARP entry in the PF2 log where you've hidden the IP.
It shows the IP moving from a CARP MAC to an physical MAC, when PF2 takes over. That seems strange to me.
Possibly the virtual IP has the wrong type or something else is miss-configured on that interface.

[ViniciusBr]

@viragomann said in HA strange behaviour, problems on passive box:

y the virtual IP has the wrong type or something else is miss-configured on that interfa

I am investigating this, but that one is a public IP, which as far as I understand I am not having issues with.

DMZ is still the problem.

[ViniciusBr]

Here are the virtual IPs:

PF1:

PF2:

[ViniciusBr]

Now the basic questions:

• why from LAN I can ping both PF1 and VIP but NOT PF2? (DMZ IPs)
  

Looking at the firewall, it is allowed:

• same issue from DMZ:
  

[ViniciusBr]

I was able to find the root cause of the issue:

Nothing to do with pfsense: vmware vs switch port access/trunk modes misconfiguration.

Thanks for the help!

[viragomann]

@viniciusbr
Thanks for coming back with clarification.

[ViniciusBr]

@viragomann Thanks for your help!