High Avail secondary node IPs - How to find it
-
@viragomann Sorry i sent a screen shot of my own pfsense not in HA mode but i wanted to ensure i didn't need to do any SNAT rules here
-
@stephenw10
So you mean for source address use the WAN interface? -
Nope the source should be the subnet (or subnets) that need to be translated to the VPN address. So whatever internet subnet(s) you;re routing over the VPN.
-
@michmoor said in High Avail secondary node IPs - How to find it:
@viragomann Sorry i sent a screen shot of my own pfsense not in HA mode but i wanted to ensure i didn't need to do any SNAT rules here
In a CARP set up you might have an outbound NAT rule in place, natting the source address to the CARP VIP. Maybe your outbound NAT is also in manual mode, not hybrid.
In this case you need an additional rule for pfSense itself as shown in my screenshot above. But it would be sufficient to have the last one of these if you don't need ISAKMP (NAT-T doesn't use it, as far as I know).
And the NAT-T rule in my screen is due to using a specific outbound IP.@stephenw10 said in High Avail secondary node IPs - How to find it:
Nope the source should be the subnet (or subnets) that need to be translated to the VPN address.
Hint: you can also state an alias here by selecting "Network" and entering the network alias with a /32 mask.
-
I appreciate you folk working with me on this thread. I think i ironed out all the issues and/or misunderstandings i was having here.
Appreciate yall !
