• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

[Solved] How should endpoints handle MAC changes during HA failover?

Scheduled Pinned Locked Moved HA/CARP/VIPs
4 Posts 2 Posters 1.1k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • M
    MrPete
    last edited by MrPete Mar 8, 2022, 9:35 PM Mar 6, 2022, 3:16 PM

    I'm having a lot of trouble on my LAN when primary CARP fails.

    Specifically, even though my pfSense DNS server is at .1 on both primary and backup, and DNS lookups work fine from pfSense, as well as from a rebooted endpoint...

    ... In general, most endpoints fail at DNS lookup initially after failover.

    Looks to me like the most likely culprit is the change in MAC address of the .1 IP.... perhaps because the ARP table has no reason to be updated.

    How is this supposed to work correctly?

    Similarly: DHCP server is the specific IP (.2 or .3) not the CARP VIP (.1) --

    • That means DHCP fails for endpoints connected to the failed pfSense
    • I see no way to configure DHCP server as .1 -- and the documentation implies that's how it "ought" to be?

    Just confused on this. :(

    1 Reply Last reply Reply Quote 0
    • M
      MrPete
      last edited by Mar 8, 2022, 12:00 AM

      @mrpete Answered my own question:

      • When HA failover occurs, the FW sends out an ARP, which should be used by switches to update as needed.

      Interestingly, something sets it up so when I ping my pfSense, the MAC address of 00:00:05:00:01:01 is known to Wireshark as a standard MAC. I can't find that address anywhere on the FW?!

      N 1 Reply Last reply Mar 8, 2022, 6:15 AM Reply Quote 0
      • N
        netblues @MrPete
        last edited by Mar 8, 2022, 6:15 AM

        @mrpete https://docs.netgate.com/pfsense/en/latest/firewall/virtual-ip-addresses.html#carp

        The carp mac is transferred to the active node. So no arp mac updates.
        The mac you see is the carp mac

        M 1 Reply Last reply Mar 8, 2022, 6:44 AM Reply Quote 1
        • M
          MrPete @netblues
          last edited by Mar 8, 2022, 6:44 AM

          @netblues
          That page does not say that... But it does link to the a page hinting at this:
          https://docs.netgate.com/pfsense/en/latest/highavailability/index.html#switch-layer-2-concerns

          • While "CARP VIPs each have their own unique MAC address derived from their VHID"
          • "At minimum, the switch must... Allow the CARP VIP MAC address to move between ports."

          Thanks! I think I am beginning to understand this... 😏

          1 Reply Last reply Reply Quote 0
          4 out of 4
          • First post
            4/4
            Last post
          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
            This community forum collects and processes your personal information.
            consent.not_received