CARP Failover

[David DeSimone]

Mike Barnard <mike.barnardq at gmail.com> wrote:
>
> FW1 is connected to SW1 and FW2 is connected to SW2. Both SW1 and SW2
> connected to the aggregating switch.
> 
> I have configured CARP in failover mode and the interesting thing is both
> firewall carp interfaces come up as master:
> 
> FW1:
> carp0: flags=49<UP,LOOPBACK,RUNNING> metric 0 mtu 1500
>         inet 41.xxx.yyy.243 netmask 0xfffffff8
>         carp: MASTER vhid 1 advbase 1 advskew 1
> carp1: flags=49<UP,LOOPBACK,RUNNING> metric 0 mtu 1500
>         inet 41.xxx.yyy.251 netmask 0xfffffff8
>         carp: MASTER vhid 2 advbase 1 advskew 1
> 
> FW2:
> carp0: flags=49<UP,LOOPBACK,RUNNING> metric 0 mtu 1500
>         inet 41.xxx.yyy.243 netmask 0xfffffff8
>         carp: MASTER vhid 1 advbase 1 advskew 100
> carp1: flags=49<UP,LOOPBACK,RUNNING> metric 0 mtu 1500
>         inet 41.xxx.yyy.251 netmask 0xfffffff8
>         carp: MASTER vhid 2 advbase 1 advskew 100

The two firewalls cannot hear each other's CARP announcements.  Test
with tcpdump; do you see the CARP packets coming from the other
firewall?  If not, you have a switching problem, like the two firewalls
are not in the same VLAN together.

If you do see the packets arriving, it probably means that your PF
policy is blocking CARP from your neighbor.

-- 
David DeSimone == Network Admin == fox at verio.net
  "I don't like spinach, and I'm glad I don't, because if I
   liked it I'd eat it, and I just hate it." -- Clarence Darrow


This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio, Inc. makes no warranty that this email is error or virus free.  Thank you.