Netgate Store

Author Topic: CARP Single Interface Failover  (Read 556 times)

0 Members and 1 Guest are viewing this topic.

Offline hancke

  • Newbie
  • *
  • Posts: 10
  • Karma: +1/-0
    • View Profile
CARP Single Interface Failover
« on: October 06, 2017, 11:27:08 am »
We have a 2 node CARP config and noticed that when the Master node has problems with a single interface, that interface shows up on the Backup node as Master.  All other interfaces stayed with the Master node.

That interface also shows as Master on the Master node.

Is that normal behavior for a single interface to failover and what does it affect?
« Last Edit: October 06, 2017, 12:53:58 pm by hancke »

Offline hancke

  • Newbie
  • *
  • Posts: 10
  • Karma: +1/-0
    • View Profile
Re: CARP Single Interface Failover
« Reply #1 on: October 09, 2017, 09:02:40 am »
A couple of things that may have caused this, I had gateway monitoring turned on and I have no need for gateway monitoring on these non-WAN interfaces.  Secondly and most likely I was using auto-created rules in NAT that referenced the physical interfaces instead of the VIP/CARP IPs.  HA/CARP needs Manual NAT (h/t Derelict)

Offline asrivas

  • Newbie
  • *
  • Posts: 1
  • Karma: +0/-0
    • View Profile
Re: CARP Single Interface Failover
« Reply #2 on: November 12, 2017, 05:34:04 am »
We had a similar situation with a primary/secondary pfsense (ver 2.4.1) instances. There are 5 interfaces on the primary and secondary instances. If one interface is turned off, only that interface becomes master on the secondary. All other interfaces remain Master on the primary. Obviously this does not work.

We checked through sysctl that net.inet.carp.preempt was  set to 1.

Also, all the interfaces must be added to the interface group name "carp". There is additional setting under interface where can you can create an interface group and add interfaces  to it. So we created the "carp" group and added the 5 interfaces to it.

After creating the group, the failover of all interfaces happens on the secondary if one interface goes down on primary and it works as expected.

Offline mgiammarco

  • Jr. Member
  • **
  • Posts: 84
  • Karma: +0/-0
    • View Profile
Re: CARP Single Interface Failover
« Reply #3 on: November 23, 2017, 11:38:29 am »
I am very interested too in this thread. I have open a similar thread above "partial failure".
In my (humble) opinion a partial failure of only one interface can be managed letting it became master on secondary.
But secondary should reach internet even when slave! And this usually does not happen.
So I suppose I will create a carp group too.
But I would like that also slave pfsense can reach internet, even when it is slave.
Mario

Offline zktech

  • Newbie
  • *
  • Posts: 21
  • Karma: +0/-0
    • View Profile
Re: CARP Single Interface Failover
« Reply #4 on: January 22, 2018, 04:19:30 pm »
We have tried adding a "carp" interface group and including the WAN, LAN and VLAN interfaces. We still get an issue where the WAN and LAN/VLAN interfaces are not moving together. We have also set net.inet.carp.preempt = 1 in the system tunables.

Any ideas would be appreciated.

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 10572
  • Karma: +1209/-324
    • View Profile
Re: CARP Single Interface Failover
« Reply #5 on: January 22, 2018, 04:44:25 pm »
What is the nature of the failure? Is it an interface down, as in no carrier, or something else?

Failover is all or nothing. If an interface fails on the primary, it demotes ALL CARP on that node and the secondary takes over.

There is no "this is active on one node and this is active on the other."
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM