thanks for reply. Upstream switch is managed cisco and "Disable preempt" is NOT ticked on master, but IS ticked on backup node. I did that because according to help line underneath - when firewall is booted, it will switch to master and I didn't wanted this feature on backup node. Or I did I get it wrong? Should I have it unticked on both nodes?
There is also worth mention that there is one cable missing on backup node - waiting for our networkers to configure it on their switch. So maybe the situation will change if all interfaces are up.
So if I understand correctly - in this case of one cable missing on backup node, if I unplug cable from master, the master node will not fail over all interfaces, but only the one that failed. Otherwise, with all interfaces up on both nodes, if I unplug cable on master, it will failover all interfaces. Is that correct?
And what part of firewall ensures that all interfaces will failover, is it kernel? AFAIK the carp is running independent on interfaces, so one carp per interface. And on the switch side, both interfaces should see each other, ie. same vlan with no restrictions.