DUPs w/pfSense CARP on VMWare
-
Hello all,
I've stumbled over https://forum.pfsense.org/index.php?topic=61770.0 as we have a similar issue.
We run several instances of pfSense clusters running on several not clustered VMWare ESXi hosts. I will describe our scenario:
VMWare host A
pfSense Cluster A node 1 (Master)
Target VM A (network behind pfSense Cluster, default gateway CARP address of cluster A)VMWare host B
pfSense Cluster A node 2 (Slave)
Target VM B (network behind pfSense Cluster, default gateway CARP address of cluster A)Both VMWare hosts have two active uplinks in the Load Balancing configuration "Route Based on Originating Virtual Port". To support CARP we have enabled "Promiscuous Mode", "MAC Address changes" and "Forged transmits". We have also enabled "Net.ReversePathFwdCheckPromisc" in order to use CARP on our VMWare hosts w/multiple Uplinks.
Symptoms:
1. When we PING from a outside client the target VM A we receive DUP PING replies.
1.1 When we run tcpdump on target VM A we do not see the DUP PING replies. When we run tcpdump on pfSense Cluster A node 1 we see the DUP PING replies.
2. When we PING from a outside client the target VM B we do not receive DUP PING replies.
3. When we set the uplinks on VMWare host A to active/standby and when we PING from a outside client the target VM A we do not receive DUP PING replies.Has anybody seen the same problem?
Kind regards,
Michael -
From what I've heard the settings for VMware must be "IP Hash based."