2 pfsense, ipsec, carp, firewall, route

[angmk]

Hi folks,

I decided to put this topic in the general questions since cannot fit in one category.. I have an issue with dual pfsense setup which I can't resolve it for a while so someone might help a bit (thanks in advance!)

The setup is following:

=> 2 pfSense 2.1 boxes (running on vSphere5)
    1xWAN, 1xLAN per box

=> There is one IPSec tunnel per pfsense box coming from different locations

=> LAN interfaces on both pfsense's are sharing the same subnet and LAN (192.168.10.0/24)
    pfsense1 LAN: 192.168.10.2
    pfsense2 LAN: 192.168.10.3

I tried to set CARP on LAN side (without additional third interface for now - just to test the functionalities) with virtual ip: 192.168.10.1
The virtual machines on LAN side with carp enabled have def gw. 192.168.10.1

The issue is that when someone tries to access LAN machine from the tunnel network in box pfsense1 it fails, it only gets to the LAN interface on the pfsense box: example: 192.168.10.2 and nothing more, nearly the same is happening without carp. Every machine (including the pfsense's in the LAN segment is reachable in-between).

Any idea what can be the culprit? Firewall rule, some incorrect setup, routing?  :-\

Previous setup was with 1 pfsense and 2 tunnels, but because one of the tunnels was falling down on a daily basis the client now wants two pfsense's for separate tunneling…
Microsoft TMG box on their side.

Promiscuous mode on the LAN port group is enabled.

Many thanks for any feedback!

Kind Regards,
Angelo