High Availibility Failover stops SSH Session

[A Former User]

This post is deleted!

[Derelict]

@vadim1 said in High Availibility Failover stops SSH Session:

On the Backup Firewall pfsync is activated and the IP of Primary is there.

Assumed to be active on the primary as well?

How about you post the actual states on the backup instead of saying has the same output.

If those are private addresses there is zero reason to obfuscate.

Are both hosts set to use the CARP VIP as their default gateways?

[A Former User]

@derelict said in High Availibility Failover stops SSH Session:

@vadim1 said in High Availibility Failover stops SSH Session:

On the Backup Firewall pfsync is activated and the IP of Primary is there.

Assumed to be active on the primary as well?

How about you post the actual states on the backup instead of saying has the same output.

If those are private addresses there is zero reason to obfuscate.

Are both hosts set to use the CARP VIP as their default gateways?

Hi Derelict,

sorry for the delay, i was in holiday.

1. Yes, pfsync is active on the primary.
2. I changed the post so you can see the actual states.
3. Yeah, you are right, i am not sure, why i was obfuscating them.
4. On the DHCP Server the CARP VIP is set as the gateway, also the hosts have a route, but running traceroute from the host to e.g. google.com, it shows me the IP of the Firewall not the CARP VIP.

[Derelict]

@vadim1 said in High Availibility Failover stops SSH Session:

VLAN200 tcp 10.10.231.252:38624 -> 10.10.231.253:519 ESTABLISHED:ESTABLISHED 0 / 0 0 B / 0 B
VLAN200 tcp 10.10.231.252:38624 -> 10.10.231.253:519 ESTABLISHED:ESTABLISHED 619.731 K / 619.733 K 34.29 MiB / 34.29 MiB

Those states are DHCP failover connections between the two firewalls and don't show anything about the SSH problems you are reporting.

If the DHCP servers are both set correctly (that setting should sync from primary to secondary), what do the clients report as their default gateway?

Generally, with pfsync running, if the clients are set to use the CARP VIP as their default gateway and outbound NAT for that client network uses the WAN CARP VIP for outbound NAT, then they will have synced states and a failover will not break the client connections.

Looking at the states will not show the default gateway used but will show the outbound NAT used (if it is necessary to NAT).

[A Former User]

@derelict said in High Availibility Failover stops SSH Session:

@vadim1 said in High Availibility Failover stops SSH Session:

VLAN200 tcp 10.10.231.252:38624 -> 10.10.231.253:519 ESTABLISHED:ESTABLISHED 0 / 0 0 B / 0 B
VLAN200 tcp 10.10.231.252:38624 -> 10.10.231.253:519 ESTABLISHED:ESTABLISHED 619.731 K / 619.733 K 34.29 MiB / 34.29 MiB

Those states are DHCP failover connections between the two firewalls and don't show anything about the SSH problems you are reporting.

before failover
Primary
VLAN20 tcp 10.10.190.5:17979 -> 10.10.224.1:22 ESTABLISHED:ESTABLISHED 180 / 116 14 KiB / 14 KiB
VLAN20 tcp 10.10.231.253:30816 -> 10.10.231.252:520 ESTABLISHED:ESTABLISHED 11.598 K / 11.597 K 657 KiB / 657 KiB
VLAN20 tcp 10.10.231.253:30816 -> 10.10.231.252:520 ESTABLISHED:ESTABLISHED 0 / 0 0 B / 0 B

BackUp

VLAN20 tcp 10.10.190.5:17979 -> 10.10.224.1:22 ESTABLISHED:ESTABLISHED 0 / 0 0 B / 0 B
VLAN20 tcp 10.10.231.253:30816 -> 10.10.231.252:520 ESTABLISHED:ESTABLISHED 0 / 0 0 B / 0 B
VLAN20 tcp 10.10.231.253:30816 -> 10.10.231.252:520 ESTABLISHED:ESTABLISHED 11.439 K / 11.438 K 648 KiB / 648 KiB

after failover

Primary

VLAN20 tcp 10.10.190.5:17979 -> 10.10.224.1:22 ESTABLISHED:ESTABLISHED 180 / 116 14 KiB / 14 KiB
VLAN20 tcp 10.10.231.253:30816 -> 10.10.231.252:520 ESTABLISHED:ESTABLISHED 11.765 K / 11.764 K 667 KiB / 667 KiB
VLAN20 tcp 10.10.231.253:30816 -> 10.10.231.252:520 ESTABLISHED:ESTABLISHED 0 / 0 0 B / 0 B

BackUp

VLAN20 tcp 10.10.231.253:30816 -> 10.10.231.252:520 ESTABLISHED:ESTABLISHED 0 / 0 0 B / 0 B
VLAN20 tcp 10.10.231.253:30816 -> 10.10.231.252:520 ESTABLISHED:ESTABLISHED 11.758 K / 11.757 K 666 KiB / 666 KiB

If the DHCP servers are both set correctly (that setting should sync from primary to secondary), what do the clients report as their default gateway?

default via 10.10.231.254 dev ens160 proto dhcp metric 100
but using traceroute it is going through 10.10.231.253, is it the way it should work or does it has to go through 10.10.231.254?
traceroute to google.com (172.217.17.238), 30 hops max, 60 byte packets
1 localhost (10.10.231.253) 0.129 ms 0.157 ms 0.183 ms

Generally, with pfsync running, if the clients are set to use the CARP VIP as their default gateway and outbound NAT for that client network uses the WAN CARP VIP for outbound NAT, then they will have synced states and a failover will not break the client connections.

Looking at the states will not show the default gateway used but will show the outbound NAT used (if it is necessary to NAT).