[Solved] How should endpoints handle MAC changes during HA failover?
-
I'm having a lot of trouble on my LAN when primary CARP fails.
Specifically, even though my pfSense DNS server is at .1 on both primary and backup, and DNS lookups work fine from pfSense, as well as from a rebooted endpoint...
... In general, most endpoints fail at DNS lookup initially after failover.
Looks to me like the most likely culprit is the change in MAC address of the .1 IP.... perhaps because the ARP table has no reason to be updated.
How is this supposed to work correctly?
Similarly: DHCP server is the specific IP (.2 or .3) not the CARP VIP (.1) --
- That means DHCP fails for endpoints connected to the failed pfSense
- I see no way to configure DHCP server as .1 -- and the documentation implies that's how it "ought" to be?
Just confused on this. :(
-
@mrpete Answered my own question:
- When HA failover occurs, the FW sends out an ARP, which should be used by switches to update as needed.
Interestingly, something sets it up so when I ping my pfSense, the MAC address of 00:00:05:00:01:01 is known to Wireshark as a standard MAC. I can't find that address anywhere on the FW?!
-
@mrpete https://docs.netgate.com/pfsense/en/latest/firewall/virtual-ip-addresses.html#carp
The carp mac is transferred to the active node. So no arp mac updates.
The mac you see is the carp mac -
@netblues
That page does not say that... But it does link to the a page hinting at this:
https://docs.netgate.com/pfsense/en/latest/highavailability/index.html#switch-layer-2-concerns- While "CARP VIPs each have their own unique MAC address derived from their VHID"
- "At minimum, the switch must... Allow the CARP VIP MAC address to move between ports."
Thanks! I think I am beginning to understand this...
