High Availability with Two OPNsense Virtual Firewalls

[spetrillo]

Hello all,

Is there a good document that details the steps to make two OPNsense vms highly available?

Thanks,
Steve

[Patrick M. Hausen]

It's the same as with dedicated hardware firewalls. Make sure the virtual network interfaces are created in exactly the same order, then follow the documentation.

[bimbar]

There are some issues with vmware, promiscuous mode and CARP.

For example: https://kb.vmware.com/s/article/2144849

https://docs.netgate.com/pfsense/en/latest/troubleshooting/high-availability-virtual.html#hypervisor-users-especially-vmware-esx-esxi

[Patrick M. Hausen]

Wouldn't you run your two virtual firewalls on two different ESXi hosts? Doesn't make much sense on a single one, does it? That's probably why I never experienced this problem. I have been running virtual firewalls in HA configurations for years.

[bimbar]

This can also happen if you have only one firewall on an ESXi, at least that's what happened to my setup with one virtual and one in hardware.