CARP IP static route

smeego78

Hi,

I'm in a bit of a bind. I've got 2 Pfsense boxes in a Hyper-V environment with a CARP setup (I have enabled mac spoofing). Scenario Lightly illustrated below;

I have static routes on the router to the 2.2.2.0/24 network with a next hop of 1.1.1.10:

Router (1.1.1.1/28) –->PFsense CARP (1.1.1.10/28) ---- 2.2.2.2/24

From the router I can ping the PFsense CARP IP fine. I cannot however ping the 2.2.2.0 network. BUT as soon as I change the next hop to Pfsense interface IP 1.1.1.2, I can reach the 2.2.2.0 network. I am not NATTing this interface by the way, just routing. The Pfsense boxes have internet connectivity and everything else seems to work fine.

Has anyone come across an issue like this before?

thanks,
Jay

smeego78

Hi,

No one has experienced this issue before? Perhaps someone may have a similar setup on VMware/KVM?

thanks

Derelict

If you enable ICMP to the CARP VIP on WAN can you ping the CARP address from the outside router?

If you packet capture on the CARP WAN does traffic arrive there destined for the CARP VIP MAC address and destined for the 2.2.2.0/24 IP address?

smeego78

Thanks Derelict.

The CARP is actually on the LAN interface. The CARP IP and both interface IPs are fully reachable from the router but if when I set the next hop address on the router to the CARP IP, I cannot reach the 2.2.2.0 network. The CARP IP is still reachable from the router and it arps too. It is only when I set the next hop to interface IP of the CARP Master that I can reach the 2.2.2.0 network. It's strange and I'm starting to wonder if it's a Hyper-V issues.

The 2 Pfsense boxes are on the same host by the way.

thanks,
Jay

Derelict

So s/WAN/LAN/g in my post and do the same tests. Is the traffic arriving on LAN destined for the LAN CARP address?

smeego78

Hi Derelict,

I've just done a packet capture on the LAN interface filtering the 2.2.2.x address. I've run a continuous ping from the router to the Pfsense address and what I've found is that when the static route on the router is pointing to the CARP IP, I am not seeing anything in the capture. But if I point it to the interface IP I start seeing the icmp requests and replies.

weird.

thanks,
Jay

Derelict

If the traffic isn't getting there there is nothing in pfSense to do. Look in Hyper-V.

smeego78

So I've moved the pfsense boxes to VMware and it seems to be the same issue. I must be doing something wrong on the pfsense boxes, if someone can kindly drop me a hint on where I may need to look.

thanks