Stateful PPPoE/CARP possible?

[rgray99c]

Hey, so I have two instances (VM's) of opnsense, wanting to set up HA, but my internet is a PPPoE connection, where im assigned a static IP. I also have a routed /29 subnet from my ISP (Routed via my static /32 IP. Is it possible to set up a stateful failover for when my primary VM goes down (Happens very often) Or have I wasted money on the /29 subnet?

[franco]

Only if you add a third box doing the PPPoE termination. Otherwise the PPPoE connection needs to bounce between the two HA boxes in active/passive fashion.


Cheers,
Franco

[Monviech (Cedrik)]

I also ran this productively for a while. It wasn't a good experience when the HA script terminated the PPPoE session and started it on the other OPNsense in case of a failover. Weird things happened, like the IPv6 Track Interface not working properly (sometimes). Most problems were IPv6 related though.

I would really make sure to do PPPoE Termination.

[rgray99c]

Would this have worked with a dhcp capable isp as opposed to PPPoE?

[Monviech (Cedrik)]

I don't understand, PPPoE is for encapsulating and decapsulating packets. DHCP is for auto configuring IP addresses.

So what works best would be a provider, where the termination offers ethernet without PPPoE. Then you would also need static IP addresses, since the CARP VIP can't be configured to be a dynamic IP address. One static /32 IP address would be sufficient, both firewalls can be set to IPv4 None on their WAN, and only the CARP VIP would have that /32 IP address. Then you can also get your other /29 net routed like that.

[bimbar]

In System -> HA -> Settings there is a setting called "Disconnect dialup interfaces", which is supposed to do what you want, but in my experience it does not work well.

[Monviech (Cedrik)]

In System -> HA -> Settings there is a setting called "Disconnect dialup interfaces", which is supposed to do what you want, but in my experience it does not work well.

Yeah it's a gamble, that's what I referenced in an earlier post. If it actually works it was pure luck and the cosmos was on your side.

[itngo]

Is this still an issue?
We have a Customer with one leased line and one pppoe for backup. Often the connection is sticked on the slave and does never come back to the master-node. We then need to reboot the slave to get the PPPOE-Connection back online on the master.

I guess it is not used to work like this?

[FraLem]

Only if you add a third box doing the PPPoE termination. Otherwise the PPPoE connection needs to bounce between the two HA boxes in active/passive fashion.


Cheers,
Franco

Hi ,
Would a third Opnsense device as PPPoE termination a recommended option for this scenario?
Regards 

[franco]

That would work, but something like a small Linux router capable of forwarding the full speed PPPoE connection would be my recommendation then, even a FritzBox. This make more sense than adding a third OPNsense in need of administration (and you still have the no HA problem there...).


Cheers,
Franco