Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Carp Failover - Only one interface doing failover

    Scheduled Pinned Locked Moved HA/CARP/VIPs
    7 Posts 5 Posters 2.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • I
      inzanez
      last edited by

      Hi

      my pfSense cluster is connected to WAN on one side, and to DMZ & LAN on the other side. WAN, DMZ & LAN are all VIPs so they should do failover. However, when the DMZ interface of the primary node failed, CARP just moved the DMZ VIP to the backup node, LAN and WAN still were active on the primary node,…and that way the DMZ was just,...unreachable. I guess this is not intended, is it?

      I can't see what I might configure different right now,...

      1 Reply Last reply Reply Quote 0
      • G
        gesture1968
        last edited by

        I had the same thing going this weekend. My two-node PFsense cluster has 3 interfaces:

        1. WAN connected to internet
        2. DMZ
        3. LAN

        I was working remote and I wanted to test a failover situation without stopping my primary node, so I disabled my WAN interface on the primary so the backup could become primary. Instantly I lost connection and could not access my LAN anymore. I could connect to the backup (now primary) but not to the LAN (or DMZ). This seems logical as the backup now holds the WAN interface and the primary the other two DMZ and LAN interfaces. Of course no traffic was passed anymore between WAN and LAN/DMZ.

        But this can't be the right solution for a failover cluster!!!

        In my opinion the only way to solve this is not just have the backup take over the failing interface, but all connected interfaces (as it would when the entire primary node fails)!

        Any other suggestions?

        1 Reply Last reply Reply Quote 0
        • G
          gesture1968
          last edited by

          Anybody please… Developers?

          1 Reply Last reply Reply Quote 0
          • K
            k22
            last edited by

            Same problem here.
            Anybody get this to work other than passthrough the NICs?
            ESXi script to shut down the vSwitch if a NIC goes down?

            1 Reply Last reply Reply Quote 0
            • R
              reinaldo.gomes
              last edited by

              This doesn't seem a problem with pfSense. Probably a layer 2 issue. I've just set up a CARP failover on pfSense 2.3 (had to enable a couple options regarding MAC address on VMWare) and everything went fine with all interfaces failing over at the same time.

              1 Reply Last reply Reply Quote 0
              • K
                k22
                last edited by

                Pull the cable on one of the interfaces and tell me if the whole VM fails over.

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  That sounds like the interface stayed up but would not pass traffic any more, either due to something on either interface (primary or secondary) or something in layer 1 (bad pair out but not in maybe) or layer 2. It is not possible for HA to know what to do in that case. Disable CARP on the malfunctioning master or unplug the failed interface / shutdown the switch port and HA will shutdown CARP on all interfaces and swing to the backup.

                  The answer is more redundancy like LAGG interfaces to stacked switches so traffic will continue to pass in a carrier-up-but-no-traffic-passing situation on one interface.

                  This image is what I get when I change the VLAN on one interface's switch port so carrier stays up but traffic (including CARP) no longer passes between nodes.

                  ![Screen Shot 2016-06-20 at 11.23.39 PM.png](/public/imported_attachments/1/Screen Shot 2016-06-20 at 11.23.39 PM.png)
                  ![Screen Shot 2016-06-20 at 11.23.39 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2016-06-20 at 11.23.39 PM.png_thumb)

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post
                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.