I want to create a multi-VM pfsense cluster ESXI. For those that are not familiar with pfsense, consider it a Free BSD based router/switch (with many features on top of it, but not necessary for this question).
Basically, I want to have two physical NICs on the ESXI - an "Input" and an "Output". The Input interface would accept packets from 1-inifinite number of hosts, and the Output interface would send them out to the Internet. See ASCII diagram below:
--[pfsense1]--
/ \
[INPUT] --------[VSW1] [VSW2]------- [OUTPUT]
\ /
--[pfsense2]--
Where:
[INPUT]
is a real, physical NIC[OUTPUT]
is a real physical NIC[pfsense1]
is a virtual machine in Layer 2 Bridge mode.[pfsense2]
is a virtual machine in Layer 2 Bridge mode.[VSW1]
is a virtual switch.[VSW2]
is a virtual switch.
In a normal, non VMWare ESXI setup, this is easily done with Spanning Tree. The functionality I want is this
- Packets entering from INPUT to VSW1 will select a single virtual machine to pass through.
- When one of the virtual machines fails, packets will automatically be forwarded through the other VM instead.
- Packets will never be "load balanced" - they will take one path or the other.
Typically, [pfsense1]
would be the highest priority, thus if it is on and functional, all traffic should pass through it. If not, then traffic will pass through [pfsense2]
.
How would one achieve this functionality? Does the solution lie within the VM (pfsense) or at the ESXI networking level? Can STP be used on vSwitches?
EDIT 1: Removed VLANs from diagram as they were from an old, test config (thanks Mario).