Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking to setup CARP following this guide across two pfSense firewalls.

I have setup CARP before on a WAN link with a big IP space, so allocating a distinct WAN IP per each device (as shown in the guide) was palatable.

Now, I am trying to do the same, but only one WAN IP is available per link.

Is there a way to use only one WAN IP?

Edit: What if you have the following configuration? (would this work?)

  • WAN1: WAN IP 1.2.3.4, local IP 192.168.10.1
  • WAN2: WAN IP 1.2.3.5, local IP 192.168.20.1
  • pf1: On interface WAN1, local IP 192.168.10.10; on WAN 2, local IP 192.168.20.10;
  • pf2: On interface WAN1, local IP 192.168.10.11; on WAN 2, local IP 192.168.20.11;
  • On both pf1 and pf2, monitor IP set to the ISP-appropriate value
  • VIP on 192.168.10.100, 192.168.20.100
share|improve this question
up vote 6 down vote accepted

No, carp requires three WAN IPs.

share|improve this answer

CARP is like VRRP, HSRP and most other routing redundancy protocols, you must have 3 static IPs in the same subnet.

That may change at some point in the future, but it's true for the time being.

share|improve this answer
    
Any VRRP / HSRP setup I've seen so far has not used IPs from the attached subnet for the cluster interfaces themselves. – Florian Heigl Dec 1 '15 at 3:42

It does not, it depends on your Setup. I have a working solution with 1 IP. The Slave just uses the Master as a gateway.

share|improve this answer
    
Would you care to share how this is done? – tacos_tacos_tacos Jul 15 '15 at 21:22
1  
On the Internet-interface i have a separate network which is being used to negotiate the VIP, the IP itself is configured as CARP IP. Other than that i just gave each Firewall a seperate gateway with lower priority which points to the other firewall so that both firewall can route to the internet. – Alessandro Meyer Jul 20 '15 at 14:53
    
wish i could upvote this more. – Florian Heigl Oct 8 '15 at 23:34
    
Alessandro, how do you manage to have the lowpri routes pointing to the other firewall? do you have the static route sync turned off? – Florian Heigl Oct 14 '15 at 20:04
    
Hi Florian - the other Firewall is just the secondary default gateway for the non-master firewall. And the first gateway is the providers gateway which is not reachable when there is no CARP IP assigned (=Slave) – Alessandro Meyer Oct 20 '15 at 7:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.