I want to create a multi-VM pfsense cluster ESXI. For those that are not familiar with pfsense, consider it a Free BSD based router/switch (with many features on top of it, but not necessary for this question).

Basically, I want to have two physical NICs on the ESXI - an "Input" and an "Output". The Input interface would accept packets from 1-inifinite number of hosts, and the Output interface would send them out to the Internet. See ASCII diagram below:

                      /               \
[INPUT] --------[VSW1]                 [VSW2]------- [OUTPUT]
                      \               /


  • [INPUT] is a real, physical NIC
  • [OUTPUT] is a real physical NIC
  • [pfsense1] is a virtual machine in Layer 2 Bridge mode.
  • [pfsense2] is a virtual machine in Layer 2 Bridge mode.
  • [VSW1] is a virtual switch.
  • [VSW2] is a virtual switch.

In a normal, non VMWare ESXI setup, this is easily done with Spanning Tree. The functionality I want is this

  1. Packets entering from INPUT to VSW1 will select a single virtual machine to pass through.
  2. When one of the virtual machines fails, packets will automatically be forwarded through the other VM instead.
  3. Packets will never be "load balanced" - they will take one path or the other.

Typically, [pfsense1] would be the highest priority, thus if it is on and functional, all traffic should pass through it. If not, then traffic will pass through [pfsense2].

How would one achieve this functionality? Does the solution lie within the VM (pfsense) or at the ESXI networking level? Can STP be used on vSwitches?

EDIT 1: Removed VLANs from diagram as they were from an old, test config (thanks Mario).

  • What is the real problem you're trying to solve here? You've told us your proposed solution, but not the problem. – EEAA Jun 16 '15 at 12:40
  • Trying to figure out how to accomplish what I've described. The problem is either that it is not possible or I am unaware of how to accomplish this. I've described the desired outcome, but unfortunately not the solution. – Ryan Jun 16 '15 at 12:54
  • Please see XY Problem. I know you think this is the best way to solve whatever problem you have, but it's likely not possible to do in the way you describe. Honestly, we want to help you, but without a clear explanation of the problem, we won't be able to do that. – EEAA Jun 16 '15 at 13:04
  • Ah makes sense. The problem I have is that when pfsense fails, or I go to upgrade it, the Internet access for certain machines will go down. I am trying to create a virtual (vmware), redundant solution so that in the event of failure, Internet connectivity will still be established. I thought CARP would be a good idea, but it does not work with Bridged hosts. Does this clarify the problem? – Ryan Jun 16 '15 at 13:41
  • If pfsense does nothing but bridge VLANs 100 and 200, can't you just get rid of VLAN 100 and connect you VMs directly to VLAN 200? This might be a stupid question but I just don't see why you want to use pfsense at all. – Mario Lenz Jun 16 '15 at 18:30

How would one achieve this functionality?

vSwitches are just that, a switch, and nothing else, if you had a physical switch how would you expect it to do this? You wouldn't, you'd probably do it via round-robin DNS or an external load-balancer.

Does the solution lie within the VM (pfsense) or at the ESXI networking level?

How about within the design and understanding of what vSwitches do? What you're trying to do has been done many times before, even using pfsense, have you looked on their own support sites (btw as we state very clear when you sign up this site is for professional sysadmins, we know what pfsense is)

Can STP be used on vSwitches?

No, vSwitches do not act as part of a Spanning Tree network, nor can they be made to.

  • If I were using physical switching, I would use STP with a Designated and Backup port, but I am not. I don't know why you would assume I don't understand what vSwitches do - I clearly stated (as did you "when I signed up for this site") that in a normal situation, I would use Spanning Tree. Do you have an actual, technical solution? – Ryan Jun 16 '15 at 11:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.