OPNsense Forum

English Forums => High availability => Topic started by: danbet on April 27, 2024, 04:22:44 PM

Title: What means "same hardware" for HA
Post by: danbet on April 27, 2024, 04:22:44 PM
For an HA configuration, the exact same hardware is required, as is said time and again. What exactly does that mean?

Do the boxes have to be exactly the same, or is it only important that the order of the interfaces is correct?
LAN = LAN
WAN = WAN
OPT1 = OPT1
OPT2 = OPT2

What does this mean for virtual machines? For example, if one is running on VMware ESXi and the other on KVM/QEMU? Does this work or not, because it is not the same "hardware"?

Or if e1000 is used as the interface in one VM under VMware ESXi and VMXNET3 in the other?
Title: Re: What means "same hardware" for HA
Post by: willempoort on November 07, 2024, 12:18:09 PM
As far as I know the Interface naming should be the same for both machines.
Do take care with e.g. NAT source rules. As it turns out by me the NAT rule will reference to the identifier given at boot (opt1, opt2, etc) instead of the one you give at the description.
Meaning that on two identical machines (DEC2770) port 0 on one machine got opt3 and opt4 on the other machine.
I'm trying to figure out how to set this identical on both machines. Editing /conf/config.xml does not help because this one is reset after restarting all services. ;)
Title: Re: What means "same hardware" for HA
Post by: emaba on November 24, 2024, 05:55:23 PM
I'm looking for a solution to the same problem.
I came across pfSense, which recently allowed you to use different hw if you have the same names: wan=WAN, lan=LAN, opt1=Sync, opt2=DMZ (https://docs.netgate.com/pfsense/en/latest/highavailability/settings.html#configuration-synchronization-settings-xmlprc-sync).

Is there anything like that in OPNSense, or is the idea to replicate the same behavior?

Thank you.
Title: Re: What means "same hardware" for HA
Post by: Patrick M. Hausen on November 24, 2024, 05:58:07 PM
You can create lagg interfaces with just a single member to work around different device names.

Also if you deploy using VLANs that of course works regardless of the hardware device as long as you name them the same.