Vlan & HA

MrGamecase

Any iodeas anyone?...

MrGamecase

Here are the steps i took for setup:

Router A (master)
create VLAN ID 10 on interface ixl0 (lan)
assign interface ixl0.10 with a static IP and enbaled it.
LAN IP is 192.168.10.2/24

Router B (backup)
create VLAN ID 10 on interface ixl0 (lan)
assign interface ixl0.10 with a static IP and enbaled it.
LAN IP is 192.168.10.3/24

Back to Router A
created CARP VIP
192.168.10.1/24
VHID group 9
frequency 1 / skew 0
checked router B and it synced the info except assigned a frequency of 1 and skew of 100

Set outbound NAT
Hybrid NAT
interface WAN
protocol any
source: network 192.168.10.0/24
translation address: WAN IP

checked router B and confiremd outbound NAT configs synced over

Firewall rule:
    Action: Pass
    ipv4
    protocol: any
    source: VOIP net
    destination: any
    port: any

checked router B and confirmed fw rule was synced.

on Router A, i enabled DHCP
    pool 192.168.10.100 - 192.168.10.200
    gatewat 192.168.10.1
    failover IP 192.168.10.3

confirmed DHCP settings dunced over to router B
    confirmed failover IP is 192.168.10.2

when i look at CARP status in each router, the status shows VOIP@9 192.168.10.1 as MASTER

what am i missing?

viragomann

@MrGamecase
It's the same as for normal networks. Your setup steps on pfSense seems all right.
So I guess, the problem is outside of pfSense.

That both are master, indicates that the nodes don't have a working layer 2 connection.
So check the switch config, which should connect both VLAN interfaces.

MrGamecase

This post is deleted!

MrGamecase

@viragomann said in Vlan & HA:

@MrGamecase
It's the same as for normal networks. Your setup steps on pfSense seems all right.
So I guess, the problem is outside of pfSense.

That both are master, indicates that the nodes don't have a working layer 2 connection.
So check the switch config, which should connect both VLAN interfaces.

So at the moment im using PROXMOX. to rey get this working before we deploy this to our main network

MrGamecase

@viragomann

So if i trunk 2 ports on my Cisco 2960s poe+ & plug the lan ports from the 2 PFsense Vms i should see the carp functin?....

viragomann

@MrGamecase
Yes. But it should also work on Proxmox.
Did you enable "VLAN awareness" on the Bridge?

MrGamecase

@viragomann

Yes Vlan awareness is enable on the Lan port in Proxmox A & B Server, i have a VM spun up with a tag of 20 and i do not get DHCP from anything apart from the primary lan ??.??.10.?? & only when ther are no vlans involved on the CARP

Prox A.png Prox B.png pfs master.png

viragomann

@MrGamecase
Maybe you have forgotten to disable hardware checksum offloading?

MrGamecase

@MrGamecase said in Vlan & HA:

@viragomann

Yes Vlan awareness is enable on the Lan port in Proxmox A & B Server, i have a VM spun up with a tag of 20 and i do not get DHCP from anything apart from the primary lan ??.??.10.?? & only when ther are no vlans involved on the CARP

Adding the Vlan ports to the carp, causes everything to display unknon peer state, Both master & backup flick to master on the vlan ports

PF Carp Master
carp pfsense a.png

PF Carp Backup
carp pfsense b.png

johnpoz

@MrGamecase this old post about ha and vlans may still come into play... I would follow derelicts instructions on how to bring up the vlan for your ha.

https://forum.netgate.com/post/531368

MrGamecase

@johnpoz said in Vlan & HA:

@MrGamecase this old post about ha and vlans may still come into play... I would follow derelicts instructions on how to bring up the vlan for your ha.

https://forum.netgate.com/post/531368

I come across this earlier but did not quie understand, I am but a simple noob when it comes doown to PFSense,

When you add VLANs and interfaces to a node in a high availability pair, the changes are not synced. When you finally add the CARP VIP to the master, that is synced.

I'm sort of new to pfSense HA, but I've been spending a bit of time with it lately and this is what I have learned:

pfSense (pfsync) syncs based on the internal interface designator. These are wan, lan, and optX. It doesn't care what your pretty interface name is.

It doesn't matter if you don't use the physical, untagged interfaces. Assign them to pfSense interfaces first thing. Make each HA node match exactly.

I can indeed confirm Each PFBox was mede exacly the same down to the ports assigned in Proxmox to the porst assigned in PFSense

viragomann

@MrGamecase
Again, did you disable hardware checksum offloading in pfSense?

MrGamecase

@viragomann carp pfsense b.png

can coinfirm this on both bopxes

MrGamecase

@MrGamecase
Receving this on the logs of the second PFServer

MrGamecase

Ok, so scrambling round for an unused switc, i have discovered the Proxmox on its own wont do layer 2 switching.. once i plugged the 2 vPFsense into a switch they started behaving as expexted....

All the CARP HA responded as primary & backup acordingly and failover works like a charm.