opnsense proxyarp and Neighbors

[MohsenB]

I setup opnsense HA with 2 servers, with proxyarp interfaces, but i have problem with proxyarp because both of opensenses advertise ARP from their interfaces and i had ARP confilect in my network and TTL expired in this problem(because some times master node found slave node mac address instead real mac address of IP),I tried resolve this problem with "Neighbors" and set the mac address of IP addresses statically.
but i found another problem ,in HA sync there isn`t any option for, master node sync "Neighbors" configs to backup node.
these are my questions:
1- can i use HA with proxyarp interface without set arp statically?
2- if i should use static arp, how can i sync "Neighbors" master and slave nodes?

[alveston]

For the 1st question: Can you use HA with Proxy ARP without static ARP?
Technically yes, but it's risky. In most cases, Proxy ARP with HA is unstable unless you implement some way of ensuring only the MASTER responds to ARP.

[alveston]

For the 1st question: Can you use HA with Escape Road ARP without static ARP?
Technically yes, but it's risky. In most cases, Proxy ARP with HA is unstable unless you implement some way of ensuring only the MASTER responds to ARP.

Syncing static ARP ("Neighbors") configs?

As others have done, you can move away from Proxy ARP entirely and use CARP.

[MohsenB]

For the 1st question: Can you use HA with Proxy ARP without static ARP?
Technically yes, but it's risky. In most cases, Proxy ARP with HA is unstable unless you implement some way of ensuring only the MASTER responds to ARP.

Yes, i have this problem , the master node ask mac address of a ip address that is in proxyarp subnet , the back up node answer it Owen mac and we have ttl expire , how can resolve this problem?

[MohsenB]

For the 1st question: Can you use HA with Escape Road ARP without static ARP?
Technically yes, but it's risky. In most cases, Proxy ARP with HA is unstable unless you implement some way of ensuring only the MASTER responds to ARP.

Syncing static ARP ("Neighbors") configs?

As others have done, you can move away from Proxy ARP entirely and use CARP.

i`m using CARP but i have problem

[Patrick M. Hausen]

i`m using CARP but i have problem

So what is the problem, exactly?

[MohsenB]

i`m using CARP but i have problem

So what is the problem, exactly?

i using the carp and proxyarp in same time on a interface but the backup node advertise mac address of ip addresses ,assigned to servers.

Can i disable proxyarp on backup node and enable it when it`s become master automatically ?
or
sync "Neighbors" between master and backup node?

[Monviech (Cedrik)]

Use Carp and Virtual IP address and put these virtual ip addresses in the same vhid group as Carp and they will move with master and backup.

[MohsenB]

Use Carp and Virtual IP address and put these virtual ip addresses in the same vhid group as Carp and they will move with master and backup.

i did this , but i have the problem yet.   
My structure is same as below:

OPNSense Master:
LAN IP:192.168.0.2/24
LAN Proxyarp:192.168.0.0/24
LAN CARP VIP:192.168.0.1/24
vhid group:1
advskew:0
switch port:1(PrivateVLAN Promiscuous VLAN ID : 100)
--------------------------
OPNSense Backup:
LAN IP:192.168.0.3/24
LAN Proxyarp:192.168.0.0/24
LAN CARP VIP:192.168.0.1/24
vhid group:1
advskew:100
switch port:2(PrivateVLAN Promiscuous VLAN ID : 100)
--------------------------
Server
IP:192.168.0.100/24
Gateway:192.168.0.1/24
switch port:24(PrivateVLAN Isolated VLAN ID : 100)

in above structure when a client wants to access "Server" through "OPNSense Master" , the "OPNsense Backup" send owned mac to "OPNSense Master" instead "Server" , and "OPNSense Master" can`t find the real server.
i resolve this problem with "Neighbors" and set "Server" mac address statically , but unfortunately , OPNSense doesn't sync "Neighbors" between nodes in HA. 
i want to know ,can i resolve this problem without "Neighbors" ? or if i must do it by "Neighbors" how can i sync the nodes "Neighbors" configuration?

[viragomann]

I'm wondering, what's the sense of Proxy ARP in your setup.

in above structure when a client wants to access "Server" through "OPNSense Master"

From the LAN or from another network segment?