Netgate SG-1000 microFirewall

Author Topic: CARP Single Interface Failover  (Read 187 times)

0 Members and 1 Guest are viewing this topic.

Offline hancke

  • Newbie
  • *
  • Posts: 10
  • Karma: +0/-0
    • View Profile
CARP Single Interface Failover
« on: October 06, 2017, 11:27:08 am »
We have a 2 node CARP config and noticed that when the Master node has problems with a single interface, that interface shows up on the Backup node as Master.  All other interfaces stayed with the Master node.

That interface also shows as Master on the Master node.

Is that normal behavior for a single interface to failover and what does it affect?
« Last Edit: October 06, 2017, 12:53:58 pm by hancke »

Offline hancke

  • Newbie
  • *
  • Posts: 10
  • Karma: +0/-0
    • View Profile
Re: CARP Single Interface Failover
« Reply #1 on: October 09, 2017, 09:02:40 am »
A couple of things that may have caused this, I had gateway monitoring turned on and I have no need for gateway monitoring on these non-WAN interfaces.  Secondly and most likely I was using auto-created rules in NAT that referenced the physical interfaces instead of the VIP/CARP IPs.  HA/CARP needs Manual NAT (h/t Derelict)

Offline asrivas

  • Newbie
  • *
  • Posts: 1
  • Karma: +0/-0
    • View Profile
Re: CARP Single Interface Failover
« Reply #2 on: November 12, 2017, 05:34:04 am »
We had a similar situation with a primary/secondary pfsense (ver 2.4.1) instances. There are 5 interfaces on the primary and secondary instances. If one interface is turned off, only that interface becomes master on the secondary. All other interfaces remain Master on the primary. Obviously this does not work.

We checked through sysctl that net.inet.carp.preempt was  set to 1.

Also, all the interfaces must be added to the interface group name "carp". There is additional setting under interface where can you can create an interface group and add interfaces  to it. So we created the "carp" group and added the 5 interfaces to it.

After creating the group, the failover of all interfaces happens on the secondary if one interface goes down on primary and it works as expected.