PFSense Suricata - High Availability?
-
Is there any documentation/support for high availability with Suricata on PFSense? We have two pfSense instances syncing via pfSync, and I would just like to make sure an installation of Suricata is compatible.
Thank you!
-
The Suricata package has a SYNC tab where you can configure the package to send its settings to one or more identical pfSense hosts. The two boxes must be identical in terms of hardware up to and including NIC types and port assignments (i.e., which one is LAN, WAN, etc.). All the SYNC does is copy settings such as configured interfaces and rules.
There is no sort of state sync or any other type of realtime data exchange between the synced packages. So not exactly HA in the true sense, but it does give you a twin version of the package should the active firewall go down and the standby takeover. However, in terms of Suricata, there would be a traffic disruption of sorts since the standby version coming online will have no idea what TCP streams the other host was seeing/handling. And there is no synchronization of blocked hosts.
