Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Issues with bridged networks on primary and secondary firewall

    Scheduled Pinned Locked Moved L2/Switching/VLANs
    2 Posts 1 Posters 507 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • maverickwsM
      maverickws
      last edited by maverickws

      Hi there,

      I have a setup where we have two pfSense firewalls, a primary and a secondary.

      This firewall has the following setup:

         |------DMZ_WAN------|      <- over VLAN.n
      _______             _______
      |XCP01|             |XCP02|
      | FW1 |             | FW2 |
         |------DMZ_LAN------|      <- over GRE tunnel
      

      The GRE tunnel is not made via pfSense, but underlying infrastructure - The same goes for the VLAN.n at the DMZ WAN side, for the pfSense it's just like the cable is directly connected to the switch

      The interfaces are bridged and configured with transparent firewalling. There is no NAT. Everything works fine with 1 bridge on the primary FW.

      Now, for resilience and redundancy, we're looking to enable the bridge at fw2.
      At the bridge advanced configuration on FW1:

      • Enabled STP/RSTP;
      • Added the respective ports to the Auto PTP Ports;
      • Selected the respective interfaces as STP interfaces;
      • Set Bridge Priority at FW1 to 3072;
      • Set Interface priority to 64;

      The secondary firewall has the default values, (32768 for bridge priority and 128 on the interfaces).

      Now what happens is:
      At the secondary firewall, as soon as I add the interfaces to the bridge, I DON'T EVEN NEED TO ENABLE THE INTERFACE, the whole network goes DOWN. Its something I'd expect from a loop on the network, without STP, but not by simply adding an interface to a bridge without it being UP.

      Currently we have the secondary bridge down and everything is working over the primary. But we'd like to implement this properly, where STP blocks the interface with the lower priority.

      What am I doing wrong here? Thanks.

      maverickwsM 1 Reply Last reply Reply Quote 0
      • maverickwsM
        maverickws @maverickws
        last edited by

        bump

        1 Reply Last reply Reply Quote 0
        • First post
          Last post
        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.