CARP alternative
-
@michmoor We have a client using private IPs as I described. Both routers can update. They actually had a small block but at the time needed multiple IPs for various services so they were all shared. (Now just one)
-
@SteveITS Yeah you can use a RFC1918 layer but its just not as clean as putting routable addresses on the WAN. Double-NAT
The concern i have with this type of design is port forwarding and/or hosting services. Not ideal but can work.
@jimp if the secondary firewall needs to install patches/packages, is that when you just flip it to Master (One WAN IP being shared).
Firewall: NetGate,Palo Alto-VM,Juniper SRX
Routing: Juniper, Arista, Cisco
Switching: Juniper, Arista, Cisco
Wireless: Unifi, Aruba IAP
JNCIP,CCNP Enterprise -
@michmoor maybe but since the shared “CARP” public IP is used on WAN there’s no practical difference in my mind.
Edit: yes if using only one IP it’d have to be master to update pfSense. Or pfB lists etc.
-
@michmoor said in CARP alternative:
if the secondary firewall needs to install patches/packages, is that when you just flip it to Master (One WAN IP being shared).
It needs to have packages and updates at all times, not just when it's master. Otherwise you'd have to fail over to it to do any sort of maintenance, which defeats the idea of HA to reduce disruptions.
