CARP Single Interface Failover
-
We have a 2 node CARP config and noticed that when the Master node has problems with a single interface, that interface shows up on the Backup node as Master. All other interfaces stayed with the Master node.
That interface also shows as Master on the Master node.
Is that normal behavior for a single interface to failover and what does it affect?
-
A couple of things that may have caused this, I had gateway monitoring turned on and I have no need for gateway monitoring on these non-WAN interfaces. Secondly and most likely I was using auto-created rules in NAT that referenced the physical interfaces instead of the VIP/CARP IPs. HA/CARP needs Manual NAT (h/t Derelict)
-
We had a similar situation with a primary/secondary pfsense (ver 2.4.1) instances. There are 5 interfaces on the primary and secondary instances. If one interface is turned off, only that interface becomes master on the secondary. All other interfaces remain Master on the primary. Obviously this does not work.
We checked through sysctl that net.inet.carp.preempt was set to 1.
Also, all the interfaces must be added to the interface group name "carp". There is additional setting under interface where can you can create an interface group and add interfaces to it. So we created the "carp" group and added the 5 interfaces to it.
After creating the group, the failover of all interfaces happens on the secondary if one interface goes down on primary and it works as expected.
-
I am very interested too in this thread. I have open a similar thread above "partial failure".
In my (humble) opinion a partial failure of only one interface can be managed letting it became master on secondary.
But secondary should reach internet even when slave! And this usually does not happen.
So I suppose I will create a carp group too.
But I would like that also slave pfsense can reach internet, even when it is slave.
Mario -
We have tried adding a "carp" interface group and including the WAN, LAN and VLAN interfaces. We still get an issue where the WAN and LAN/VLAN interfaces are not moving together. We have also set net.inet.carp.preempt = 1 in the system tunables.
Any ideas would be appreciated.
-
What is the nature of the failure? Is it an interface down, as in no carrier, or something else?
Failover is all or nothing. If an interface fails on the primary, it demotes ALL CARP on that node and the secondary takes over.
There is no "this is active on one node and this is active on the other."
