STP and network



  • Is there any reason why the attached network diagram wouldn’t work or cause problems? The top one doesn’t work, the bottom one does.

    All traffic on same network/bridge /24 - IP is only set on WAN side (no NAT and no subnet). I get weird problems as soon as pfSense is connected - it has RSTP activated, the same goes for all the switches.

    The “weird” problems consists of randomly loss of communication between computers on the same network oposite WAN (LAN, OPT1, OPT2). For instance, Internet works on the machine, but traffic like local app-server to db-server only would work one direction or partly. Our backup-machine that connects to all the local computers would get tcp errors shortly after starting. Things like a connection string test and small packets would work, so when I ran a MS SQL connection string test from windows, it would say success. But .net apps and stuff that needs a bit more data would stop.

    There are no IP-conflicts as far as I can see, I have run a commercial tool to rule that out.

    One thing that I have experienced 6 years ago or so (I didn’t have STP active then I think), was that a machine had been set up as bridge instead of bond and short-circiut the network. But I have not found that now (checked all machines as good as I know, the bond or team looks good) and cisco loopback detection and RSTP is running on switches. So instead of shortcut the circut, it should only block that port (would be easy to find the problem then!).

    Help!


  • Rebel Alliance

    What are you trying to accomplish exactly?  What switches are you working with… Are you trying to connect the server via a lagg / port channel to load share or handle a switch port or server interface failure?



  • Two SG200-50 switches - it’s layer 2 switches.

    Three goals:

    • Keep network alive even if one out of two switches goes down (power cable, firmware upgrade, broken konfig)
    • Keep servers alive even if a path to one of the switches (for instance due to bad physical connection or network card) goes down.
    • As a bonus: Using ALB against two GBs port in each server, I get 2 Gbit/s instead of 1 and can load balance - specially usefull when running backups.

    And yes, I’m using in-built Teaming under Windows (no switch dependency) and Bonding (ALB) under Linux. Load sharing LAG on each server.

    I want to have only one single point of failure and that is the pfSense (I have a cold standby for that). Currently, If I loose SW1, I will loose the entire network (SW2 is now connected to it) and have to go out and physically replace it or bypass it. Have the same system for power and couldn’t live without it: If one PSU, PDU or UPS fails, it is taken care of automatically on the second line with no intervention.


  • Rebel Alliance

    So you have 2 interface your pfsense that you are setting up in lagg to these switches?  You would use LACP normally in such a setup.
    https://doc.pfsense.org/index.php/LAGG_Interfaces

    As to how you set that lagg/portchannel/etherchannel to your Server device that would be up to the OS and hardware on it.

    But 200 series are pretty low end switches.  You can not stack them.  You can not create a VPC through them, etc.  So what your trying to do your hardware is lacking…  Off the top of my head the lowest model that supports stacking would be the sg500 line in the cisco smb switch market…

    You would then put your 2 switches in a stack and setup a lacp lagg from pfsense to the switch stack with ports going to different switches in the stack.

    You could prob setup stp and then just connect into 2 interfaces on a bridge on pfsense as sort way to MacGyver the solution…  But to be honest if your server is so important that it needs to be up, then you should be using hardware that actually supports doing such stuff in an enterprise…

    Normally switches that would be doing vlans would be interconnected… Your first drawing shows no interconnection between the switches. So you wouldn’t have the same vlans on these switches, etc.

    If on your bottom drawing you connected another interface that is in a bridge to your bottom switch, leaving the interconnect between the switches… You could prob got some sort of STP failover solution going… Since STP running on your switches should shutdown any loops they find… But yeah that is a real MacGyver solution to be sure… Not something I would do…

    I wold think if you have a 50 port switch go down you got a few more problems then just 1 server not able to get to the internet 😉

    If your concerned with failover to the point you don’t want a single point of failure then you should have stackable switches with multiple power supplies 😉  And your pfsense should be in a CARP setup, etc.



  • “So you have 2 interface your pfsense that you are setting up in lagg to these switches?  You would use LACP normally in such a setup.”

    True if I was to connect two links to the same switch, to form a trunk. Here it is a single link to each switch, so LACP/LAG is not an option with this setup. I’m using STP already, in every device.

    The switches has very small amounts of traffic (maybe top of 200 Mbit when many backups are run), so if I was to upgrade it, it would only be to stack them - and is it worth it then. My issue with stacking or kind of automatic sync is that I don’t completely trust it and that debugging it (who is causing the problem) becomes even more difficult. In this setup, I can kill the power to one switch causing problem and solve a single switch problem - while still have 100% uptime.

    The risk isn’t just that the switch goes down, it can also be bad TP-cable or cable is bent to far etc. on one single server-connection. I migth solve this using LACP to each server, but a lot extra administration.

    BTW: If I had stackable switches, even with multiple powersupply, how would it solve my problem? I would still need a gbe-connection to more than one switch to avoid the risk of one going down.

    I have one pfSense in standby-actually, but I wanted to see if I could get the basic up and running. I assume it wouldn’t solve anything to have this 2nd pfSense running in CARP and be source to the 2nd switch? I assume that would only be to move the problem up one level?


  • Rebel Alliance

    “I would still need a gbe-connection to more than one switch to avoid the risk of one going down.”

    That is how you would normally do it… With 1 port going to 1 switch in a STACK and another port to another switch in the STACK via a LACP lagg.

    Sounds like to me your causing yourself grief over nothing… I have been in the biz for 30 years.  Have never seen a cable just go bad… While its connected… Not like I have not run into bad cables… But not like you connect a cable to a port and 2 years later the cable goes bad…

    Port go out on a switch sure - just move the cable…  Then again in the enterprise, servers are always connected to a STACK… And yes have seen switches in a stack go bad…  But that is why you put them in a stack to begin with 😉  So that if 1 goes bad your network doesn’t really even notice…



  • @johnpoz:

    “I would still need a gbe-connection to more than one switch to avoid the risk of one going down.”

    That is how you would normally do it… With 1 port going to 1 switch in a STACK and another port to another switch in the STACK via a LACP lagg.

    Ah, so what you are saying is that when you do stacking, you can define a LACP lagg for instance on two ports (on different switches) against a single server? That sounds like a possible solution for me, it would be more controllable and I assume the config is present on all switches in the stack in case of one goes down. I would have to find a switch that can define many LACP, the non-stack switch I have now only supports 5 trunks/LACP. Does most stack-switches support unlimited?

    Updated: Or… do you maybe thing it is enough only to have a LACP to these two switch/pfSense! That would be far simplier. Then I would only need two SG500-52 in LACP and can have lower-cost distribution switches down the lane? I assume it is not possbile to define a LACP on SG200 like I have now, since you can only define LACP on one switch unstacked.

    Sounds like to me your causing yourself grief over nothing… I have been in the biz for 30 years.  Have never seen a cable just go bad… While its connected… Not like I have not run into bad cables… But not like you connect a cable to a port and 2 years later the cable goes bad…

    True, not the most common case. It has happened to me because I had to mutch cable-bend during install of a another server. Or that I by accident removes the cable or disconnect the wrong cable in the switch (it it was connected two places, the server would still be up).

    Port go out on a switch sure - just move the cable…  Then again in the enterprise, servers are always connected to a STACK… And yes have seen switches in a stack go bad…  But that is why you put them in a stack to begin with 😉  So that if 1 goes bad your network doesn’t really even notice…

    Ok, somehow I have missed the concept of stacking. I assumed it wasn’t needed at all. When you setup Teaming in Windows, the documentation says that you can team network connections with different speeds and that no switch configuration is needed (there is an option, choosen by default, that is called switch-independent). Would love to have a network that just worked like power-cables… just connect it and it works 😜

    When you are 1000 miles away, it’s nothing easy about moving that cable 😉 I’m running a small business where I wouldn’t be able to afford everything and I have to go on holiday sometimes.


  • Netgate

    So you have igb1, igb2, and igb3 in a bridge? Why igb2 and igb3 on the other link? Why not just one? Does it work with just one?

    You should be able to get that working with RSTP.

    I have never tried ®STP on pfSense because pfSense is not a switch.

    Two stacked switches with an LACP member to each (and a TEAM NIC to each on the other side) is more along the lines of what you want.

    You might need to take a good look at what STP is doing - who is the root bridge, what are all of the different ports settling on as far as states, etc.



  • SW1 is listed as root-bridge in the “working”-setup above (I have checked on SW2), but maybe it changes when the error occours. I have to really plan for what to look for and do it during nigth when not so many customers notice problems.

    @Derelict:

    So you have igb1, igb2, and igb3 in a bridge? Why igb2 and igb3 on the other link? Why not just one? Does it work with just one?

    As soon are there are more than one physical connection, the problems start. So even only with igb1 going to SW1 and igb2 going to SW2, it is problems.

    The reason for having more than one is to have redundancy.

    Well, if I add another switch, I will introduce another possible week link in series. Also, the switch needs to be rack-mountable, having dual powersupply (or connected to ATS-switch), added cabling… So it adds on a lot just for one extra redundant link. Based on a speed-test, I didn’t notice any delay with regards to throughput or time (ms).

    But I agree, I think that stacked switches really are my option. But is it possible to only go for stacked LACP against the pfSense (two connections) and then have the first drawing without setting up LACP to each server (we are talking many)? I suspect that could work as well?


  • Netgate

    What? You LACP to pfSense then use whatever “teaming” you want with one link to each switch for the backend. Or LACP, or whatever.

    The reason for the stack is so you can have LACP member links on two switches.

    You must have either stacking or Multi-Chassis Trunking to do that. MCT is usually pretty spendy.

    You don’t need to spend a lot of money. Two of these will do all the stacking and LACP you want:

    https://www.ebay.com/itm/Brocade-ICX6430-24-24-Ports-Managed-Gigabit-Ethernet-Switch-4x-SFP-TAE/371925972476?hash=item569883f5fc:g:VvAAAOSw3ZRY-RtF

    $180 for the pair. If you find ICX-6450s you will get 2 x 10G uplink/stacking ports instead of 1G and base layer 3. But the 6430s stack using two 1G trunk ports just fine.

    Good switches are sexy

    
    ICX6450-24 Router#sh stack
    T=1d12h37m15.0: alone: standalone, D: dynamic cfg, S: static
    ID   Type          Role    Mac Address    Pri State   Comment                   
    1  S ICX6450-24    active  cc4e.247f.8cc0 128 local   Ready
    2  S ICX6450-24    standby cc4e.2406.a160   0 remote  Ready
    
        standby      active                                                        
         +–-+        +---+                                                        
      2/1| 2 |2/3--2/1| 1 |2/3                                                     
         +---+        +---+                                                       
    Standby u2 - protocols ready, can failover
    Current stack management MAC is cc4e.247f.8cc0
    
    


  • Thank you so much, seems like stacking is the way to go  🙂



  • When checking out LAG-features in pfSense, I see that only a single LAN-interfaces (OVPN3) are available in the LAG-sceen (under Parent device). Is this because I have these interfaces in bridge-mode?

    I do need the fw to be in transparent mode since I have the same IP/network on WAN/LAN - any way to solve this?



  • What? You LACP to pfSense then use whatever “teaming” you want with one link to each switch for the backend. Or LACP, or whatever.

    I am pretty sure he is sitting in a thinking trap of his own mind! He is owning switches that are not capable of
    doing what he wants to realize, an redundant core of a network switch. There are some methods to do so, but
    in all cases the switches must be supporting some things as well. Please have a look on the network graphics
    to understand why he is talking about using LAGs in that case. There are more then one LAG type to go with.

    Building a switch core stack will be one thing and going by different redundancy protocols will be another on.
    Please accept that the Cisco SG200 switches are great, but they are Layer2 only and does not coming with
    redundancy protocols or will be sufficient sorted right with different supporting LAG methods as needed in
    that case you wish to realize. Or in shorter words please get other switches.

    Well known Switch redundancy protocols:
    Virtual Router Redundancy Protocol - VRRP
    Virtual Switch Redundancy Protocol - VSRP
    Hot Standby Router Protocol - HSRP

    Alternate protocols or workarounds:
    Policy based Routing - PBR
    TRILL from Brocade

    For the implementation of any or all of this protocols, you must perhaps pay license fees according to the circumstance
    that this protocols are  proprietary. And here might be also the angle point to implement it in any OpenSource software
    due to this licenses, or in other words inserting this into the pfSense CE image (Community Edition). If there will be once
    a day a paid version of pfSense this will be no problem or it will be less complicated to insert such a protocol or more of them.

    LAGs - static - dynamic and crossed:
    Actually there are three LAG methods mostly used;

    • Dynamic LAG using the LACP
    • Static LAG must be manually and on both ends configured totally identical
    • Cross LAGs and this is used if there are two core switches and let us imagine two switch stacks with 5 switches each
      and from each switch in that switch stack one wire or cable will be driven to one of the core switches acting as one LAG.
      As shown in the picture “core stacking” this art and wise is here meant.

    Switch stacks:
    There are also some different versions out on the market to stack up switches acting as one unit and being better
    able to manage with less hassle and also doing mass configurations, firmware updates and backups over a
    configuration software such as Netgears MNS300 is. In the free version this software will be able to
    manage up to 200 switches in one entire network.

    • Stacking over SFP/RJ45 ports either with 1 GBit/s or 10 GBit/s this is called a poor mans stack and
      it let one member failing and then the second will be the master.

    • Stacking over stacking bays and with stacking modules will be more comprehensive and offers more
      then the poor mans method, if one switch is failing, the second will be overtaking and the switch above
      and under will be also taking over the half of the data plane throughput, that means if this switches are
      acting with a 80 GBit/s througput, after failing of one switch the switch above and under are running now
      with 40 GBit/s of the throughput. Shown in the picture “stackFailSafe” and “fullduplexstack”.

    • the last one is something between this both methods and supports not all given options and features
      such as real stacking with bays and modules but more then the poor mans methods and it is able to use
      over the whole building and across over buildings, it is in a spine - leaf manner. Netgear´s M4300 Series
      is offering such switches with a fully Layer3  routing such as RIP, OSPF, VRRP, PIM, PBR and without any
      license upgrade needed!

    So in your case the Cisco SG500x variant for around ~900 € will be a good bet here.



    ![core stacking.jpg](/public/imported_attachments/1/core stacking.jpg)
    ![core stacking.jpg_thumb](/public/imported_attachments/1/core stacking.jpg_thumb)









  • Thank you for info, I’m probably going for stack-hardware. The cost isn’t that big compared to the ones I have, but the benefits looks big.

    I can get this for probably 30% lower price than Cisco, plus it has 4x10 Gbit SFP+ stacking ports compared to 2x1 Gbit from Cisco: D-Link SmartPro DGS-1510-52X
    Cisco has a stronger name/brand, but I think their UI is a bit targeted against professionals and doesn’t give that much info.

    But my question remains: How may I use LACP-team on the pfSense when I have transparent mode on (since I can’t choose any of the LAN-ports)… I will try it later today in a spare pfSense, I have a theory that maybe it works if I remove the bridge, then activate the LACP-ports and after that join the ports into the bridge again. Or maybe it wouldn’t work… If anyone knows if this is possible, you would spare a lot of time if you could say so now…



  • Yeah, I was correct it seems 🙂 Had to deactivate all LAN-interfaces and then I could create the LACP-team (was created as LAN) and then bridge WAN and LAN.

    However, I was not able to ping anything on the LAN-interface. I have enable/assigned the LAN-interface and it shows up as connected. But nothing comes through. I was able to ping the gw from the console, but noting on the LAN.

    I have a any-any on the LAN in fw rules.


  • Rebel Alliance

    “I have a any-any on the LAN in fw rules.”

    What about your bridge rules - thought you wanted this to be a transparent firewall?



  • @johnpoz:

    “I have a any-any on the LAN in fw rules.”

    What about your bridge rules - thought you wanted this to be a transparent firewall?

    Yes, I do. So you are indicating that I’m missing any fw rules on the virtual interface (like OPT3) I activated with the bridge and need to create an any-rule there as well? I thougth I had, but have to go back to data center ot be sure. Please let me know if that was what you ment or not.

    I have had it working as a transparent firewall/bridge for a year or so, that part I know is possible, but maybe there are some details I’m overlooking now…


  • Rebel Alliance

    depends on how you setup the bridge…

    https://doc.pfsense.org/index.php/Interface_Bridges

    Do you have
    net.link.bridge.pfil_member and net.link.bridge.pfil_bridge under System > Advanced on the System Tunables tab. With them set at 0 and 1, respectively, then filtering would be performed on the bridge only.



  • This was my setting just now (somehow, it has changed since last time - I restored the pfSense backup to a new server and maybe lost some config):

    net.link.bridge.pfil_bridge Packet filter on the bridge interface 1
    net.link.bridge.pfil_member Packet filter on the member interface 1

    From documentation, it looks like I’m supposed to only have one of them set to 1. I changed it to be:

    net.link.bridge.pfil_bridge Packet filter on the bridge interface 1
    net.link.bridge.pfil_member Packet filter on the member interface 0

    This should control the traffic onto the bridge only and not between the local interfaces. But this last step made all traffic bypass the firewall-rules I have on WAN-side as well… I could connect to computers over the Internet that I did not have opened up for. Is this because the Bridge-interface is controlling traffic both directions? How could I control it only one way?

    I was under the impression that when I have a bridge, I can control the traffic from the Internet-side (WAN) and onto the bridge combined (LAN1, OPT1 etc).

    How would I set this up so that I can control the traffic from WAN-side and in from the Internet - I do not need to restrict the traffic out from local side and out on the Internet. I have all rules on WAN-side today.



  • So what I want…

    1. Create team (LACP) on pfSense (with two physical interfaces, LAN1, OPT1). The new joined local interface will be called LAN and will be connected against two stacked switched with LACP there also. This part is easy to do as far as I can tell and the interface appear as LAN as it should.

    2. Create bridge with WAN and LAN, where I will have rules for incoming traffic from the Internet on the WAN-side. My ISPs gw is also on the WAN-side. Seems easy as well.

    3. Add Bridge to a virtual interface, like OPT3?

    4. Maybe using pfil_member=1, pfil_bridge=0 against the LACP team is the correct choice instead of the normal pfil_bridge setting in this case? So that I can control traffic one direction only.

    I’m having public static IPs on my webservers on the LAN-side, that is the only reason why I have transparent fw setup.

    Please let me know the correct settings in this scenario or at least an example that should work.


  • Netgate

    The absolute best thing to do is get your upstream to assign a small interface address for your WAN and ROUTE the subnet of addresses to you.

    Then you can just put the routed subnet on an inside interface and forget about this transparent bridge stuff.

    Have you asked them if they can do that?



  • I thougth I was close to a solution now, so would prefer to make it on my own. No, I though I had the simplest solution already 😜 They assign a public range for me and I can just use it on servers. And I don’t have to do NAT for every service and so on.

    I come from using FortiGate and this was pretty straigthforward without to much technical knowledge of networks. But now I have to actually understand things 😉

    Do you mean to assign a local range of IPs instead, that are fewer than I have today on a different subnet?

    Do you have a way to make it like I have it now, so I can compare the methods?


  • Netgate

    You get a WAN interface of, say 198.51.100.32/30. Your default gateway is 198.51.100.33 and your interface is 198.51.100.34/30.

    They route 203.0.113.64/29 to 198.51.100.34.

    You put 203.0.113.65/29 on an inside interface and turn off NAT.

    You give hosts on that network 203.0.113.66 - 203.0.113.70.

    No bridging mess.

    No NAT.

    Exactly how it’s supposed to be.



  • Ok, I have asked my ISP about this and wait for answer. I do also have some failover system that is not mentioned here, that happens transparent to me.

    But, to have it transparent like today with the LACP-trunk, how would I do it? The way I have it working as of today, is apparantly by filtering on the member interface. As soon as I filter only on the bridge, the traffic is loose. In my mind (without thinking about networks), it seems logical that new LAN-team-interface is beeing filtered this way.


  • Rebel Alliance

    Just to stress… Having your public range routed to you is way better than any transparent/bridge nonsense 😉  What size public range do you have?  /29 is pretty small… But if /28 or bigger I would for sure think it should be routed to you vs just attached to their network.

    I personally even if having to work with attached network vs routed would just nat it and use port forwards.  Simple enough to use your specific IPs for different servers via vips…



  • Have /24-range, with 256-addresses. It hasn’t been stressfull so far the last 10 years, since I don’t do a lot of network-stuff or have any special routing/requirements. Think this is the first time I have had problems and that is because I want it to be more redundant by using LACP 🙂

    Most of my servers are web-servers with control-panels that requires a certain IP to bind to (due to licenses). If I was to have local ips on all servers and have mapping to the public-ip for all servers, I suddenly have to mange 256-addresses * 2. And that is before I have to NAT all ports for common services like DirectAdmin and cPanel-servers use. Now I can simply group the servers based on profile.

    But I’m sure there are ways to do this simple in NAT as well.


  • Netgate

    It is pretty much insane to have that network on your WAN interface. It should be routed to you instead.


  • Rebel Alliance

    You have a /24 and its not routed to you??  Wow… That is nuts dude… I would for sure change that…  put pfsense in carp, then get some stack switches between your pfsense carp and your servers and now your cooking with gas… 😉



  • Have never even been thinking of that, or that there was any disadvantage of running it transparent. When starting this business, I was told that NAT-was slower (performance-wise) and required more setup. The FortiGate I started with supported that easy.

    But basically, with your suggestion, I would get assigned additional small network with public static IPs just for my WAN-area. And I could then just remove the bridge on my LAN side and threat the public IPs like I would do on a private network? I don’t have any NAT today, so wouldn’t have to change there.

    Based on this, I shouldn’t even have to change the fw rules I think, so that’s a good thing. Let’s see what my ISP says, maybe there are some kind of setup here that differ from the normal. But I’m still curious to how I would complete the setup in case my ISP says no…


  • Rebel Alliance

    Wish I could be more help with bridges on pfsense.  But software bridges should be avoided at all costs if you ask me.  While your use of it is very valid setup when under the restrictions of having to have a public range directly attached vs routed and wanting to put a firewall in between.

    So while your use of transparent is valid, I would suggest if possible migrate away from it.  If you had small amount of space like a /29 or even /28 nat with vip and then 1:1 would remove your issues of having to deal with port forwards…  Doesn’t remove the issue if you have software licensed to some IP… What if you loose your public space?  Do you actually own this /24 in arin or whatever RIR you might be in?  If so you should be able to get your own ASN and just route it yourself to wherever you want via your ISP your using, etc.

    I manage a /16 from arin… So never run into these sorts of issues.  We just advertise the space we need to use where ever, and be done with it 😉  You just need to work with whatever ISP to accept and advertise out your routes, etc.

    But if you just got said /24 from some DC network your located in - they really shouldn’t have any issues with routing it to you vs directly attaching it to their equipment.



  • @johnpoz:

    What if you loose your public space?  Do you actually own this /24 in arin or whatever RIR you might be in?

    I don’t own it, just renting it as long as I need it. If I was to change ISP, it would be a bit difficult (lot of dns to change…), but not impossible. Can change the IP for the license from control-panels.

    OK, I’ll hope that my ISP comes with good news and if not, I’ll just have to try and fail until it works 😉



  • I have two ports in my datacenter assigned with my current C-net/24-net (an Catalyst owned/administered by my ISP only). Both of the ports work, I currently only use one of them.

    I have two pfSense and I consider doing CARP on them (instead of having just a cold-turned-off ready) and have one port to each of my fw.

    Would I ask my ISP for a network of two IPs and then assign WAN-IP to each of the pfSense… or do they need to route it to only one IP/device? I’m beginning to suspect that your suggestion - along with a carp setup - requires me to introduce one additional switch/router. Then I migth as well keep the cold-backup to avoid introducing (more) single-point of failture.

    “You get a WAN interface of, say 198.51.100.32/30. Your default gateway is 198.51.100.33 and your interface is 198.51.100.34/30.”

    BTW: is this reccomendation just because how pfSense works with bridge or would you reccomend this setup no matter what type of firewall?


  • Rebel Alliance

    If you need more address on your wan transit network for a carp, then use a /29 vs /30… Yes carp requires 3 IPs… So /30 wouldn’t work.



  • Doesn’t carp communicate over a local IP only? So a dedicated cable on a port not part of LAN/WAN, just a dedicated cable with virtual 10.0.0.1/10.0.0.2 on each?

    And then one public WAN-IP for each.



  • My ISP says this:

    "This should be possible yes - the challenge is how to be able to route the current network, if you have two firewalls at 2 different WAN-addresses. Without major changes, I can only route /24-network to one address.


  • Rebel Alliance

    you could always split the /24 into 2 /25s and route 1 to each…  All comes down to how you want it.  Or if you setup carp on your 2 firewalls then you would only be routing to 1 IP, the CARP address on your wan side.

    I would have to go back and read the thread if you had laid out how you have your 2 firewalls setup and different networks behind them, etc.



  • “Or if you setup carp on your 2 firewalls then you would only be routing to 1 IP, the CARP address on your wan sid”

    This is the prefered method, but I assumed it wasn’t an option? If so, it is perfect!

    Let’s say that they assign a 5 public static IP-transport-network to me, where 80.80.80.81 is the main/assigned interface. The fw1 gets .82 and fw2 gets .83.

    I create a local link between a free interface on both, with two static local IPs to maintain the carp…  and I put .81 on the cluster.

    Is it as simple as that? If so, it would be pefect, but I assume it is more to it 😉



  • Like the drawing attached. I’m using fake static IPs of course, but maybe it is more clear what I want to do?

    The 4.4.4.0-network indicate the current /24 network I’m assigned today. I wouldn’t need to change the servers from what I have today (I think)
    The 8.8.8.0-network indicate the new small transport-network, that will be assigned both WAN and the cluster/CARP on WAN-side.



  • Rebel Alliance

    Nope its really that simple 😉

    https://doc.pfsense.org/index.php/Configuring_pfSense_Hardware_Redundancy_(CARP)

    I have not read thru that doc in awhile - so maybe its a bit dated, maybe something has changed in newer versions.  But yeah its pretty simple to setup the carp…

    This shows a nat network behind - but you could put your routed network behind there two… You setup your stack switches and some laggs - and yeah buddy cooking with gas… And remove all your SOPF issues.



  • I think it was the routed network that made me thing it wasn’t possible.

    What would my GW be on the inside on each machine, would it be the same as the cluster IP from the transport network like 8.8.8.1 in my drawing? Or can I create additional interface on the cluster (virtual IP or something) so that I can have the same gw as today? (4.4.4.1).


 

© Copyright 2002 - 2018 Rubicon Communications, LLC | Privacy Policy