XG1537's in hot spare mode?
-
I have two identical XG1537's. They are exactly as pictured below. I would like to set these up with one unit being the primary and the second unit being a hot standby. I would like to have it so that the two units are sync'd and if the primary goes down I would only have to move the WAN and LAN connections from unit 1 to unit 2. Is it possible to have the two systems setup this way?
-
@tinfoilhat
Surely you can to this. Configure WAN and LAN interfaces equal on both nodes (and VLANs if available) and the sync interface like it's described in the docs: Sync Interface Addressing.But why won't you run them in real HA CARP mode? Is it due a lacking WAN switch or do you need a PPPoE on WAN? A cheap dumb switch would do the job.
-
@tinfoilhat Doing full HA allows for pfSense updates as well, without downtime. Without that you’d still need to connect router2 occasionally to update.
Do you have an ISP router that provides a private NAT range? Then you can use private IPs on WAN 1 and 2, and your public IP as the shared IP.
-
@viragomann
Thank you for the information.
The company's ISP only allows for a single dynamic IP address. -
@steveits
No, it is an ISP modem only. No other functionality. All private addressing is done from pfSense. The gateways will handle DNS, DHCP, VLANS, two DMZ's, pfBlockerNG, Suricata, etc. -
@tinfoilhat said in XG1537's in hot spare mode?:
The company's ISP only allows for a single dynamic IP address.
As far as I know, there is a way to configure CARP with a DHCP WAN IP, but PPPoE doesn't work.
-
@viragomann
I have read the Netgate documentation regarding Single Address CARP. This brief paragraph states there are significant challenges with updating, etc. I tried to look around for more information on this type of setup. What info I did encounter seemed to be people who were spoofing the WAN MAC Address on the secondary unit and using scripts to determine the interface state(ifup/ifdown) in an attempt to avoid collision.
I would be hesitant to put any real trust in hacks of this nature in a corporate production environment.Edit: PPPoE is not being used.