OPNsense Forum

English Forums => High availability => Topic started by: prokocool69 on December 20, 2023, 11:26:07 AM

Title: Sync states without carp
Post by: prokocool69 on December 20, 2023, 11:26:07 AM
Hello! Could you please help. I've two opnsense firewalls in HA pair. But i don't use a carp technology, only dynamic routing. Should states are synced in that configuration? On this moment it's not.
Title: Re: Sync states without carp
Post by: Monviech (Cedrik) on December 20, 2023, 11:34:33 AM
States aren't synched with the CARP protocol, they are synced with pfsync protocol.

https://man.freebsd.org/cgi/man.cgi?pfsync%284%29

System: High Availability: Settings
Best use a dedicated interface as Synchronize interface between both firewalls, since there is high multicast traffic. Leave the "Synchronize Peer IP" empty. You have to create a Firewall rule that allows pfsync protocoll on both firewalls on the interface thats the Synchronize interface.

Please note that both firewalls need to have the exact same interfaces and the exact same interface names.

After you have configured pfsync on OPNsense, you can see what it's doing by "tcpdump -i pfsync" and also looking at the state table in both firewalls.
Title: Re: Sync states without carp
Post by: prokocool69 on December 20, 2023, 11:40:31 AM
thank you for your reply. I've dedicated interface between two firewalls and i've create a pass rule for this interface, but states doesn't synced? What could be the problem?
Title: Re: Sync states without carp
Post by: prokocool69 on December 20, 2023, 11:45:00 AM
"Please note that both firewalls need to have the exact same interfaces and the exact same interface names." I think this is the problem, I have different interface names.
Title: Re: Sync states without carp
Post by: Monviech (Cedrik) on December 20, 2023, 01:00:27 PM
Yeah if both firewalls interfaces arent literally the same names and the same configuration + same network drivers, don't use statesync. It will break states and won't work.
Title: Re: Sync states without carp
Post by: prokocool69 on December 27, 2023, 06:35:39 AM
I've done all interfaces similar on both firewalls. But pfsync still doesn't work. tcpdump -i pfsync0  on both firewalls doesn't show any traffic. What could be the problem?
Title: Re: Sync states without carp
Post by: mimugmail on December 27, 2023, 07:23:23 AM
Screenshots of HA settings and fw rules please
Title: Re: Sync states without carp
Post by: prokocool69 on December 27, 2023, 07:50:33 AM
FW rules on sync interface
Title: Re: Sync states without carp
Post by: prokocool69 on December 27, 2023, 07:50:55 AM
HA settings
Title: Re: Sync states without carp
Post by: mimugmail on December 27, 2023, 08:12:54 AM
Can you try to point the Failover IPs of the other firewall instead of the multicast address?
Title: Re: Sync states without carp
Post by: prokocool69 on December 27, 2023, 08:13:29 AM
i've rebooted one firewall  and pfsync now works fine. Thank you for your support)