Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Pfsync IPsec Failover Issues

    Scheduled Pinned Locked Moved HA/CARP/VIPs
    1 Posts 1 Posters 879 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • X
      xRadeon
      last edited by

      We are testing an IPsec site to site solution using pfSense. We have deployed two pfSense VMs in VMware and have setup pfsync and XMLRPC Sync between the two nodes (We enabled all the settings we need to on the port groups). We also configured two CARP VIPs, one for inside and one for outside. We've tested the failover while pinging through the firewall and CARP performs perfectily. We configured a IPsec VPN using the outside CARP address and we can bring up the tunnel to our remote S2S node.

      The issue is with IPsec and how long it takes to failover when rebooting/master fails/etc. When we failover the firewall to the secondary node it takes up to 3 minutes to re-establish the IPsec tunnel and about 8 minutes to failback once the master is up (during both times the remote client is unreachable for the entire duration). My question is, with pfsync enabled, shouldn't the CARP failover happen seamlessly? The IPsec states should be synced between the two nodes so it should just take a second for CARP to flip the VIP over the secondary node so IPsec shouldn't even go down at all. Is there any special configuration settings we need to make to ensure an IPsec seamless failover can happen? If so where is it located at? If this is expected behavior is there any way to reduce the time it takes to failover?

      See attached images for HA, CARP, and IPsec (P1, P2 and adv) settings.

      Thank you for your time.
      ![ha settings.PNG](/public/imported_attachments/1/ha settings.PNG)
      ![ha settings.PNG_thumb](/public/imported_attachments/1/ha settings.PNG_thumb)
      ![Carp VIP.PNG](/public/imported_attachments/1/Carp VIP.PNG)
      ![Carp VIP.PNG_thumb](/public/imported_attachments/1/Carp VIP.PNG_thumb)
      ![IPsec P1 settings.PNG](/public/imported_attachments/1/IPsec P1 settings.PNG)
      ![IPsec P1 settings.PNG_thumb](/public/imported_attachments/1/IPsec P1 settings.PNG_thumb)
      ![IPsec P2 settings.PNG](/public/imported_attachments/1/IPsec P2 settings.PNG)
      ![IPsec P2 settings.PNG_thumb](/public/imported_attachments/1/IPsec P2 settings.PNG_thumb)
      ![IPsec adv settings.PNG](/public/imported_attachments/1/IPsec adv settings.PNG)
      ![IPsec adv settings.PNG_thumb](/public/imported_attachments/1/IPsec adv settings.PNG_thumb)

      1 Reply Last reply Reply Quote 0
      • First post
        Last post
      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.