**Title:** OPNsense HA + BGP with our own ASN and /24 — what architecture is recommended?
Hi everyone,
I would like to get some advice on the recommended architecture for using **BGP with OPNsense HA**, with two physical firewalls, our own IPv4 /24 prefix, and **IPsec VPNs that need to work redundantly across both firewalls**.
Our environment has:
- 2 physical OPNsense firewalls;
- HA configured with **CARP + pfsync + configuration synchronization**;
- A **Master/Slave** architecture, where the Master handles normal operations and the Slave takes over in case of failure;
- **Both firewalls need to be able to take over and operate the IPsec VPNs** during a failover;
- Our **own ASN**;
- Our own **IPv4 /24 prefix**, which will be advertised to our ISP;
- Both firewalls have independent physical connections to the same ISP.
So, we have two independent physical links:
```text
ISP 10.52.70.1 <----> OPNsense 01 10.52.70.2
ISP 10.52.70.5 <----> OPNsense 02 10.52.70.6
```
For BGP, we have flexibility with our ISP and can use **either a single BGP session or two independent BGP sessions**, one for each firewall.
### Option 1 — Two BGP sessions
```text
ISP
/ \
BGP BGP
| |
10.52.70.1 10.52.70.5
| |
10.52.70.2 10.52.70.6
OPNsense 01 OPNsense 02
MASTER SLAVE
\ /
---- HA/CARP ---
```
This is the setup we are currently using.
Each physical firewall has its own BGP session with the ISP, using our ASN and advertising the same /24 prefix.
The HA failover itself works: when we put the Master firewall into **maintenance mode**, traffic successfully moves to the Slave firewall.
However, we are seeing a behavior that makes us question the BGP architecture: **even after traffic has moved to the Slave, some flows appear to return through the Master firewall**, resulting in asymmetric routing.
At the same time, we need the Slave to take over not only the normal traffic handled by the Master, but also the **IPsec VPNs**, keeping connectivity during the failover.
This is what led us to question whether using **two independent BGP sessions**, one on each firewall, is actually the recommended approach for an OPNsense HA pair, or whether we should use a single BGP session associated with the active/Master firewall.
### Option 2 — Single BGP session
The other possibility would be to use a single BGP session associated with the Master firewall, with the Slave taking over the BGP session during a failover.
Our main question is **which of these two approaches is considered the more appropriate/recommended architecture for OPNsense in a HA setup with two physical firewalls, our own ASN, our own /24 prefix advertised via BGP, and IPsec VPNs that need to operate redundantly**.
We would especially like to understand how the OPNsense/FRR project recommends structuring this type of setup.
Thank you!