bidirectionnal sync
-
hello all
i'm trying to figure out whether bidirectionnal sync between 2 pfsense firewalls is supposed to work. from my experience, it does not, but i fail to find any clear confirmation in the documentations.
as a secondary question, can anyone confirm that configuration performed on the master node will eventually reach the slave node even when said config is performed while the secondary node is down or unreachable ? how long will it take assuming i do not modify any setting at all on the master that may trigger a sync ?
thanks for your time
-
@skullnobrains said in bidirectionnal sync:
i'm trying to figure out whether bidirectionnal sync between 2 pfsense firewalls is supposed to work
No.
@skullnobrains said in bidirectionnal sync:
can anyone confirm that configuration performed on the master node will eventually reach the slave node even when said config is performed while the secondary node is down or unreachable ?
Yes
@skullnobrains said in bidirectionnal sync:
how long will it take assuming i do not modify any setting at all on the master that may trigger a sync ?
Once the secondary is back online it won't receive the settings until something on the master triggers a sync. It wouldn't happen automatically.
-
thanks a lot for the information.
--
would you happen to know whether than feature is planned ? this would greatly help converting folks who are used to work with multi-master or masterless clusters and have come to become allergic to master-slave.
actually, this is my case including manual firewall setups with ipf/pf and carp interfaces and i honestly fail to see the point of keeping this limitation.
--
is there a way to list the items that could not be properly synced ?
-
There are no plans to implement bidirectional sync or multi-master.
There isn't a way to list things that didn't sync. It syncs everything during every sync, it doesn't just track and sync specific things that changed.
-
ok, thanks a lot.
got it : complete sync alleviates the usefulness of tracking changes individually
i'll figure out a script of some sort to retry sync on failure or possibly trigger sync manually periodically, with a way to prevent this behavior if some changes where performed on the slave manually
i assume carp load sharing is a no-go as well
--
i think i can work with master-slave in my current situation, but assuming i have time to code a working multimaster sync tool or shared config-push tool, would netgate be interested into adding the feature to the stock pfsense ?
thanks again for the hints
-
@skullnobrains said in bidirectionnal sync:
i assume carp load sharing is a no-go as well
Correct. There is no active/active CARP, and no plans for it.
@skullnobrains said in bidirectionnal sync:
would netgate be interested into adding the feature to the stock pfsense ?
As far as I'm aware, we do not have any interest in that. We are focusing any effort in that area on working toward a proper API rather than adding to the current less-than-ideal methods.
