Backup firewall thinks it's the Master



  • Hi,

    I'm currently unable to have my backup firewall fully recognise that it's not the master, it only has the WAN VIP's set as Master, the rest correctly are set as Backup as can be seen below.

    This is setup on a Hyper-V cluster and the two VM's were on separate hosts but I've moved them back onto the same host incase it was the Layer 2 switch which was filtering the Multicast traffic. I'm running pFsense 2.4.3 on both firewalls.

    The primary firewall does sync the config correctly so any NAT entries etc get instantly copied onto the backup firewall as expected.

    I have everything setup as per the instructions here

    Master
    Master
    Master
    Master
    Master
    Master
    Backup
    Backup
    Backup
    Backup
    Backup
    Backup

    This is the output of the packet capture, which to me looks like the WAN interfaces are having Multicast traffic blocked. If I run a capture from the other interfaces I can see the Primary firewall correctly advertising.

    From master Server
    
    15:23:27.905751 IP 111.111.111.111 > 224.0.0.18: CARPv2-advertise 36: vhid=4 advbase=1 advskew=0 authlen=7 counter=2513118231863990170
    15:23:27.905753 IP 111.111.111.111 > 224.0.0.18: CARPv2-advertise 36: vhid=2 advbase=1 advskew=0 authlen=7 counter=4600427427365908371
    15:23:27.905886 IP 111.111.111.111 > 224.0.0.18: CARPv2-advertise 36: vhid=3 advbase=1 advskew=0 authlen=7 counter=16969553043371695779
    15:23:28.931190 IP 111.111.111.111 > 224.0.0.18: CARPv2-advertise 36: vhid=3 advbase=1 advskew=0 authlen=7 counter=16969553043371695779
    15:23:28.931316 IP 111.111.111.111 > 224.0.0.18: CARPv2-advertise 36: vhid=2 advbase=1 advskew=0 authlen=7 counter=4600427427365908371
    
    
    From backup Server
    
    15:25:43.326437 IP 111.111.111.112 > 224.0.0.18: CARPv2-advertise 36: vhid=3 advbase=1 advskew=100 authlen=7 counter=12107231961857631236
    15:25:43.326439 IP 111.111.111.112 > 224.0.0.18: CARPv2-advertise 36: vhid=2 advbase=1 advskew=100 authlen=7 counter=13768645510008379376
    15:25:43.326440 IP 111.111.111.112 > 224.0.0.18: CARPv2-advertise 36: vhid=4 advbase=1 advskew=100 authlen=7 counter=5530884825783091352
    15:25:43.326858 IP 111.111.111.112 > 224.0.0.18: CARPv2-advertise 36: vhid=3 advbase=1 advskew=100 authlen=7 counter=12107231961857631236
    15:25:43.326880 IP 111.111.111.112 > 224.0.0.18: CARPv2-advertise 36: vhid=2 advbase=1 advskew=100 authlen=7 counter=13768645510008379376
    
    

    Help! :)

    Thanks


  • Netgate

    They can't see each other's multicast CARP advertisements.

    Check your switching layer that they are both connected to.


 

© Copyright 2002 - 2018 Rubicon Communications, LLC | Privacy Policy