HA+CARP for pfSense on VMware ESXi and promiscuous mode issue

[mauro.tridici]

Dear Expert Users,

I've set-up 2 pfSense in CARP on two ESXi nodes and, following the available documentation, I've created another port-group only for pfSense with promiscuos mode enabled.

Problem is that now pfSense receives all traffic that goes to the Virtual Switch, so LAN interface it's "flooded" by unwanted traffic and, more important, from within pfSense it's possible to sniff all the traffic that goes through the virtual switch.

Can I create a firewall rule to make pfSense ignore the unwanted traffic? If yes, could you please show me an example rule?
Or, alternatively, is there another way to be able to have CARP working on ESXi without promiscuous mode?

Thank you very much,
Mauro