[SOLVED] pfSense CARP on KVM Hypervisor?

fraenki

Hi,

I'm running pfSense on a KVM Hypervisor (oVirt/FC19), which is working just fine. But for some reason CARP is not working.

I can see the VRRP advertisements on my KVM hypervisor coming in from one pfSense VM…


kvm# tcpdump -i vnet13 -s 1500 -n -X  |grep -i vrrp
tcpdump: WARNING: vnet13: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on vnet13, link-type EN10MB (Ethernet), capture size 1500 bytes
11:17:46.386437 IP 10.10.10.1 > 224.0.0.18: VRRPv2, Advertisement, vrid 2, prio 0, authtype none, intvl 1s, length 36
11:17:47.353269 IP 10.10.10.1 > 224.0.0.18: VRRPv2, Advertisement, vrid 2, prio 0, authtype none, intvl 1s, length 36
11:17:48.363266 IP 10.10.10.1 > 224.0.0.18: VRRPv2, Advertisement, vrid 2, prio 0, authtype none, intvl 1s, length 36

… but they never reach the interface of the secondary pfsense VM. Besides that the CARP IP is not reachable from any other host. The ARP table shows this:


kvm# arp -a | grep pfsense
pfsense-carp.example.com (10.10.10.10) at <incomplete>on mytestint
pfsense1.example.com (10.10.10.1) at 00:aa:44:00:xx:xx [ether] on mytestint</incomplete>

Is CARP supposed to work on KVM Hypervisors or are any specials tweaks and configs required to make it work?

Thanks

Frank

fraenki

OK, this was easy to solve. My KVM Hypervisor is oVirt… I wasn't aware that they introduced the network-filters feature which prevents guests from spoofing other mac-addresses than these which are assigned by the oVirt engine.

I just needed to disable this anti-spoofing feature. Now uCARP and CARP is working as expected :-)

More information is available from this post on the ovirt-users mailinglist.

jsvg

Can you describe how you did this? Didn't find the hints on the user list. Thanks!

ravnos_kun

Just in case someone needs:

1. In the ovirt-engine run: engine-config -s EnableMACAntiSpoofingFilterRules=false
2. Restart the ovirt-engine service
3. Halt and start the vms (a simple reboot does not work)
4. Re-run the test

Also, be sure the vms interfaces are e1000 (not virtIO)

mosesBD

i am also having issue with carp running kvm/qemu with libvirt.
the devices see each other and choose master and slave respectively but if i turn one off the clients cannot access the virtual ip anymore.
is this fix applicable in my case and if so how do i do it?