Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Can't PING carp virtual IP

    HA/CARP/VIPs
    5
    7
    2.9k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      jostir
      last edited by

      Hello,

      I have realize a VMware workstation infrastructure.

      On my LAN , I have create two windows server 2012 virtualized with the Hyper-V role.
      Then, on each HYPER-V, I have virtualize a pfsense. So I have two pfsense on my infrastructure.
      Each pfsense has 3 network interfaces (LAN , WAN, PFSYNC ). Synchronization between PFSENSE'S is done on interfaces "PFSYNC".
      Then, i have created a CARP failover cluster between these 2 PFSENSE with a common virtual IP on the WAN (192.168.10.254).
      About rules, all are allowed (pass) on three interfaces.
      Next, when I ping this virtual IP on my pfSense the response is : OK (with the diagnostic ping) but when I do a ping with a client machine on the WAN, it doesn't work.

      My question is: How to do the ping from my client machine (this machine is on my Vmware) to the virtual IP (192.168.10.254) ?

      Any idea about the problem?

      Thank you!

      1 Reply Last reply Reply Quote 0
      • dotdashD
        dotdash
        last edited by

        I'm going to overlook the complete insanity of running a virtual firewall inside of a hypervisor inside of a hypervisor and just tell you to check the WAN rule and verify you are allowing ICMP from any to the WAN Subnet. Now I'm going to go try and unsee that diagram.

        edit- If that doesn't help, try posting in the virtualization forum. Maybe you can open a virtualization sub forum in the virtualization forum for virtualizing within a virtual environment.

        1 Reply Last reply Reply Quote 0
        • J
          jostir
          last edited by

          Thanks for your help! We've checked the WAN rules and they seem to be correct (we've allowed ICMP in all subnets.) Are there any other common verifications that you would recommend we do ? Thanks again!

          1 Reply Last reply Reply Quote 0
          • dotdashD
            dotdash
            last edited by

            Maybe something with the virtualization. You should post the question in the virtualizaion forum.

            1 Reply Last reply Reply Quote 0
            • E
              eunite
              last edited by

              I am dealing the same problem with Jostir. CARP LAN VIP mac address can be found on servers (topology same as Jostir) but VIP can not ping. Any one can help to resolve this problem.

              1 Reply Last reply Reply Quote 0
              • B
                Bessa
                last edited by

                i too have this problem

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  Packet capture on the WAN. If the traffic arrives but there is no response (there will be) it's something on the firewall.

                  If the traffic doesn't arrive (it will start with ARP traffic) then it's something in your virtual infrastructure, switching, etc.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post