I'd have prefered that a more experienced person answer this one, but they don't seem to have, so be forewarned: everything I say here might be wrong. However, through the glory of mail lists, if I say something wrong, fifty people will jump all over me, and Google will put it at the top of the list when people google for my name. :)
Ralf Hornik Mailings wrote: > Dear list, > > I set up two OpenBSD 3.7 -stable firewalls using carp. Everything works > except preemption. > > When only one interface on the master side fails (pull the Cable) the > regarding carp0 interface on the backup side becomes master. But not > carp1. Right. Nothing's wrong with the master carp1, why should it demote itself and have the backup take over? > I waited some minutes, but carp1 keeps being backup until I do a simple > ifconfig(8) on the master side. Then it changes immediately. yep. (though I'm not entirely sure I know what command you are typing by "simple ifconfig(8)".) > I can reproduce it, waiting some minutes, or only a fiew seconds. Once I > do an ifconfig on the master side, the backup side becomes master on all > carp's. Strange...? not really, if you understand the modular approach here. > My config: ... > Can anybody reproduce it, and has a solution for this problem? > Any help would be very nice! :-) Look at the pieces here: * CARP gives you redunancy on your INTERFACES...not your entire firewall. * pfsync keeps your firewall state tables in sync, so either machine can take over. If you lose a box completely, your system is fine. If you lose one cable or one NIC or so on, you have a problem. What you need is something that will watch all interfaces and shut down ALL (forcing a COMPLETE fail-over) if something goes wrong with any. That's a third part of the CARP toolset: ifstated(8) and ifstated(5). Yes, that's missing from the PF FAQ, though I just tossed a couple links in faq/pf/carp.html. More will get added when I get more knowledge of the topic (or Joel writes it :) Nick.
