I want to create a multi-VM pfsense cluster ESXI. For those that are not familiar with pfsense, consider it a Free BSD based router/switch (with many features on top of it, but not necessary for this question).
Basically, I want to have two physical NICs on the ESXI - an "Input" and an "Output". The Input interface would accept packets from 1-inifinite number of hosts, and the Output interface would send them out to the Internet. See ASCII diagram below:
--[pfsense1]-- / \ [INPUT] --------[VSW1] [VSW2]------- [OUTPUT] \ / --[pfsense2]--
[INPUT]is a real, physical NIC
[OUTPUT]is a real physical NIC
[pfsense1]is a virtual machine in Layer 2 Bridge mode.
[pfsense2]is a virtual machine in Layer 2 Bridge mode.
[VSW1]is a virtual switch.
[VSW2]is a virtual switch.
In a normal, non VMWare ESXI setup, this is easily done with Spanning Tree. The functionality I want is this
- Packets entering from INPUT to VSW1 will select a single virtual machine to pass through.
- When one of the virtual machines fails, packets will automatically be forwarded through the other VM instead.
- Packets will never be "load balanced" - they will take one path or the other.
[pfsense1] would be the highest priority, thus if it is on and functional, all traffic should pass through it. If not, then traffic will pass through
How would one achieve this functionality? Does the solution lie within the VM (pfsense) or at the ESXI networking level? Can STP be used on vSwitches?
EDIT 1: Removed VLANs from diagram as they were from an old, test config (thanks Mario).