Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Implementing CARP failover in live setup

    Scheduled Pinned Locked Moved HA/CARP/VIPs
    9 Posts 2 Posters 3.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      miloman
      last edited by

      Hi

      I've been asked to implement a failover solution in a production environment that's currently running a single PfSense server as primary firewall.

      The firewall currently has about 20 public IP's configured as Proxy ARP virtual IP's. What do I do with these? Can i just change the type to a CARP address without any disruption of traffic flow?

      I'm asking because i want to make the implementation as painless and non-disruptive as possible.

      1 Reply Last reply Reply Quote 0
      • marcellocM
        marcelloc
        last edited by

        First of all, do a config backup

        Then:

        • Configure the second pfsense

        • Assign one of your public ips to this new pfsense

        • configure sync between both(configure sync on its own interface or vlan)

        • start to change ips to carp

        Try it not on production hours.

        Treinamentos de Elite: http://sys-squad.com

        Help a community developer! ;D

        1 Reply Last reply Reply Quote 0
        • M
          miloman
          last edited by

          That's exactly what i was thinking i would do.  :)

          What's the difference between P-ARP and C-ARP adresses besides the ability to do failover?

          1 Reply Last reply Reply Quote 0
          • marcellocM
            marcelloc
            last edited by

            Carp is designed for fail-over and sync between two boxes.

            Treinamentos de Elite: http://sys-squad.com

            Help a community developer! ;D

            1 Reply Last reply Reply Quote 0
            • M
              miloman
              last edited by

              I'm just thinking for future scenarios…

              I have a couple of other customers with single-node pfsense firewalls. They too are using PARP adresses for natting ip's to webservers and such... Would it be adviseable to change their PARP adresses to CARP so their setup would be ready for a failover solution in the future?

              1 Reply Last reply Reply Quote 0
              • marcellocM
                marcelloc
                last edited by

                Change to carp only when you have the second box to sync.

                To use carp, you need al least three ips on same network. One for each pfsense and others to balance.

                Treinamentos de Elite: http://sys-squad.com

                Help a community developer! ;D

                1 Reply Last reply Reply Quote 0
                • M
                  miloman
                  last edited by

                  Yes i need 3 ip's for each interface. But just to be sure that we understand each other… Here's an example:


                  fw00
                  wan: 1.1.1.2
                  lan: 2.2.2.2

                  fw01
                  wan: 1.1.1.3
                  lan: 2.2.2.3

                  carp-wan: 1.1.1.1
                  carp-lan: 2.2.2.1

                  In my scenario fw00 has 4 extra IP's on the WAN interface. 1.1.1.20, 1.1.1.21, 1.1.1.22, 1.1.1.23... These IP adresses would be entered as CARP adresses...I wouldn't need to configure anything additional on the fw01 for the failover to work, right?

                  1 Reply Last reply Reply Quote 0
                  • marcellocM
                    marcelloc
                    last edited by

                    That's right.

                    Treinamentos de Elite: http://sys-squad.com

                    Help a community developer! ;D

                    1 Reply Last reply Reply Quote 0
                    • M
                      miloman
                      last edited by

                      Perfect… Thank you so much for the sparring. :)

                      1 Reply Last reply Reply Quote 0
                      • First post
                        Last post
                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.