Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Connect from CARP member to LAN device

    HA/CARP/VIPs
    2
    6
    529
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      jokabo last edited by

      Hello,

      I have the following problem:

      • CARP HA with 2 members
      • Each member has multiple interfaces for different VLANs
      • Each interface has a small subnet, in this example 10.0.16.0/28
      • With virtual IPs, I extend the interfaces to make more subnets known. In this example, the problem-subnet is 10.0.0.16/28

      The reason for smaller subnets are, that I can manage the firewall rules with more details.

      My problem now is, that the routes for the virtual IPs are present only in the master CARP member.

      So what I have:
      pfSense 1 (master): 10.0.16.2
      pfSense 2 (slave): 10.0.16.3
      Interface CARP-IP: 10.0.16.1

      Then I have added the IP 10.0.16.17/28 via virtual IP with CARP type as gateway.

      On the second member, I can see only the route for 10.0.16.0/28.
      The route for the subnet 10.0.16.16/28 is missing on the slave node. This means that the slave-pfSense tries to route the LAN-Device IP 10.0.16.19 via WAN. This is wrong and will not work.

      So the question:
      How can I be sure that the routes are created on both sides, OR how can I tell pfSense to route the traffic maybe over the master appliance?

      Any idea?

      Thanks!

      V 1 Reply Last reply Reply Quote 0
      • V
        viragomann @jokabo last edited by

        @jokabo said in Connect from CARP member to LAN device:

        Then I have added the IP 10.0.16.17/28 via virtual IP with CARP type as gateway.

        What? What is CARP type gateway here?

        J 1 Reply Last reply Reply Quote 0
        • J
          jokabo @viragomann last edited by

          @viragomann de4af373-a3d4-4132-ab86-1f1518083768-image.png

          V 1 Reply Last reply Reply Quote 0
          • V
            viragomann @jokabo last edited by

            @jokabo
            Has the secondary box an IP address on the SGCORE interface in 10.0.16.16/28?

            J 1 Reply Last reply Reply Quote 0
            • J
              jokabo @viragomann last edited by

              @viragomann said in Connect from CARP member to LAN device:

              10.0.16.16/28

              Hi,

              no, because 10.0.16.16/28 is not an interface, it's just declared as a virtual IP.

              But SGCORE with 10.0.16.0/28 is defined on primary and secondary. And the virtual IP is also known on the secondary. But the route is missing and I think this is because the virtual ip is marked as "backup".

              Thanks!

              V 1 Reply Last reply Reply Quote 0
              • V
                viragomann @jokabo last edited by

                @jokabo
                So you had just to add it as type IP alias on the master, select the proper CARP address at interface, otherwise it doesn’t failover properly.

                1 Reply Last reply Reply Quote 0
                • First post
                  Last post