DHCP Failover is stuck in funky states for some Interfaces/VLANs

[pyrodex]

I've configured HA failover following https://www.thomas-krenn.com/en/wiki/OPNsense_HA_Cluster_configuration as a guide.

I've got four internal interfaces:

• LAN - 192.168.14.0/23
• IoT - 192.168.24.0/23
• DMZ - 192.168.220.0/24
• GUEST - 192.168.215.0/24

The firewalls are configured as so:

• Firewall A - ALL VLANS configured as .2
• Firewall B - ALL VLANS configured as .3

The .1 for each of those VLANs mentioned above is configured as a CARP  and that is working fine.

On the DHCP side I have the .3 configured as the failover peer IP for Firewall A and for Firewall B the .2 failover peer IP is configured. All of them have 255 as the failover split right now.

When this is all setup and the sync is done I noticed some of the DHCP sync peers don't fully work. When I check sockstat for dhcp ports listening/established it seems 2 of the 4 are in a SYN_SENT state and the other 2 are established and working.

It seems the DMZ and LAN subnets are the ones in the SYN_SENT state and not working as seen here:

Code: [Select]

root@firewall:~ # sockstat -ss | grep dhcp
dhcpd    dhcpd      63054 4  dgram  -> /var/dhcpd/var/run/log
dhcpd    dhcpd      63054 5  stream /tmp/php-fastcgi.socket-1
dhcpd    dhcpd      63054 7  tcp4   192.168.215.2:519     192.168.215.3:8510                 ESTABLISHED
dhcpd    dhcpd      63054 14 udp4   *:67                  *:*
dhcpd    dhcpd      63054 15 tcp4   192.168.24.2:519      192.168.24.3:8511                  ESTABLISHED
dhcpd    dhcpd      63054 16 tcp4   192.168.215.2:519     *:*                                LISTEN
dhcpd    dhcpd      63054 18 tcp4   192.168.24.2:519      *:*                                LISTEN
dhcpd    dhcpd      63054 19 tcp4   192.168.220.2:52769   192.168.220.3:519                  SYN_SENT
dhcpd    dhcpd      63054 20 tcp4   192.168.220.2:520     *:*                                LISTEN
dhcpd    dhcpd      63054 21 tcp4   192.168.14.2:52770    192.168.14.3:519                   SYN_SENT
dhcpd    dhcpd      63054 22 tcp4   192.168.14.2:520      *:*                                LISTEN
root     syslog-ng  10178 20 dgram  /var/dhcpd/var/run/log
_dhcp    dhclient   65442 5  stream -> ??
_dhcp    dhclient   29199 5  stream -> ??
root@firewall:~ #

I do know on the LAN and DMZ subnets I have "Deny unknown clients" enable but not sure if that is causing any issues but it is a weird situation and welcome any guidance and/or help.