From owner-freebsd-net@FreeBSD.ORG Fri Jan 28 18:09:56 2011 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 83A89106564A for ; Fri, 28 Jan 2011 18:09:56 +0000 (UTC) (envelope-from ddesimone@verio.net) Received: from relay1-bcrtfl2.verio.net (relay1-bcrtfl2.verio.net [131.103.218.142]) by mx1.freebsd.org (Postfix) with ESMTP id 36B1D8FC23 for ; Fri, 28 Jan 2011 18:09:56 +0000 (UTC) Received: from iad-wprd-xchw02.corp.verio.net (unknown [198.87.7.165]) by relay1-bcrtfl2.verio.net (Postfix) with ESMTP id D9531B038CFB for ; Fri, 28 Jan 2011 12:39:24 -0500 (EST) Thread-Index: Acu/Ek3IrOZJm+htRjaqt4XdBTnddw== Received: from dllstx1-8sst9f1.corp.verio.net ([10.144.2.50]) by iad-wprd-xchw02.corp.verio.net over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675); Fri, 28 Jan 2011 12:39:23 -0500 Received: by dllstx1-8sst9f1.corp.verio.net (sSMTP sendmail emulation); Fri, 28 Jan 2011 11:39:22 -0600 Content-Transfer-Encoding: 7bit Date: Fri, 28 Jan 2011 11:39:21 -0600 From: "David DeSimone" To: Content-class: urn:content-classes:message Importance: normal Priority: normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.4721 Message-ID: <20110128173921.GY316@verio.net> Mail-Followup-To: freebsd-net@freebsd.org References: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Disposition: inline In-Reply-To: Precedence: bulk User-Agent: Mutt/1.5.20 (2009-12-10) X-OriginalArrivalTime: 28 Jan 2011 17:39:23.0488 (UTC) FILETIME=[4D268E00:01CBBF12] Subject: Re: CARP Failover X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Jan 2011 18:09:56 -0000 Mike Barnard wrote: > > FW1 is connected to SW1 and FW2 is connected to SW2. Both SW1 and SW2 > connected to the aggregating switch. > > I have configured CARP in failover mode and the interesting thing is both > firewall carp interfaces come up as master: > > FW1: > carp0: flags=49 metric 0 mtu 1500 > inet 41.xxx.yyy.243 netmask 0xfffffff8 > carp: MASTER vhid 1 advbase 1 advskew 1 > carp1: flags=49 metric 0 mtu 1500 > inet 41.xxx.yyy.251 netmask 0xfffffff8 > carp: MASTER vhid 2 advbase 1 advskew 1 > > FW2: > carp0: flags=49 metric 0 mtu 1500 > inet 41.xxx.yyy.243 netmask 0xfffffff8 > carp: MASTER vhid 1 advbase 1 advskew 100 > carp1: flags=49 metric 0 mtu 1500 > inet 41.xxx.yyy.251 netmask 0xfffffff8 > carp: MASTER vhid 2 advbase 1 advskew 100 The two firewalls cannot hear each other's CARP announcements. Test with tcpdump; do you see the CARP packets coming from the other firewall? If not, you have a switching problem, like the two firewalls are not in the same VLAN together. If you do see the packets arriving, it probably means that your PF policy is blocking CARP from your neighbor. -- David DeSimone == Network Admin == fox@verio.net "I don't like spinach, and I'm glad I don't, because if I liked it I'd eat it, and I just hate it." -- Clarence Darrow This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio, Inc. makes no warranty that this email is error or virus free. Thank you.