Move from single firewall to HA

Honest_Matt

Is there a documented way to move from an existing pfsense setup to a 2 node HA setup, without manually having to recreate all the rules & VPNs?

Many thanks,
Matt

MrPete

@honest_matt Not documented, but here are some hints that may help. I'm still in the process:

Convert your existing setup to use CARP VIP's (Virtual IP's - Firewall->Virtual IP) as the primary IP, and an alternate IP for direct access to that box. The CARP IP should be the gateway for any VLAN etc. It also should be what is provided as DHCP and DNS IP in DHCP server.
Change your WebGUI to specify a specific port for SSL instead of the default 443. You'll want this later with HAproxy. (It's set in System->Advanced->TCP Port)
Add an additional interface just for sync. I call mine HA. Give it its own subnet, and add a rule for HA that allows the HA net to talk to HA net freely.
Do NOT yet define HA sync stuff.
Do a backup. Save the XML file. Examine the XML. Record the interfaces assigned to WAN, LAN, and OPT1-n -- the new/mirror box must have the exact same interfaces assigned the same way.
Put the backup XML on a USB stick, name the file config.xml
Set up the mirror pfSense. Reboot with the USB stick in place, and NOT connected to your WAN or LAN. It should auto-configure itself with everything from the primary box.
Attach directly to the new box. Change the interface IP's to be different from the other box. Leave WAN undefined for now. Once that's done you should be able to attach the HA Sync ethernet.
Follow standard instructions to define HA Sync / XML-RPC on Primary and Secondary. At this point, any changes on primary should propagate to secondary.
You're on your way... there is still more to configure.

It's a pretty big deal ;)