is it possible to configure more than 2 pfsense for HA?
-
Is it possible to have more than one primary and a secondary pfSense instance?
The reason is to improve loadbalancing and full flexibility over physical locations and have a very flat scaling (every (hardware) box for it-self approach)
iam thinking a primary + 2 or 3 secondary's to start with.
-
@planetinse I was able to configure config sync from the second to the third box, that was a long time ago.
I was using this for DNS sync. -
@planetinse Somewhere in the docs there’s a sentence or two about it. IIRC it’s theoretically possible but they’ve never tested it, or something to that effect.
-
HA is not and has never been "load balancing" -- it's active/passive.
Adding a third node is possible in theory for some scenarios but it's not supported. At a minimum it requires manually adjusting some values (e.g. manually syncing VIPs and setting appropriate skews). It's still only one active node and then multiple passive nodes, however.
Config sync can be chained, A->B->C->[...]-->n but it's not something I'd suggest relying upon.
-
@jimp Yea i know - but there is no other way when a single instance can not take the load, especially since it's a single CPU process only
(see load below) - other ways to solve this ? please enlighten me :-)
I have handled this in the past by simply unlink CARP sync and manually set skew for VIP's to loadbalance load over two HA's
Example:
so some customers has fw1 as primary and some other customers has fw2 as primary - failover still works.
