On 6/9/20 12:27 AM, Paul B. Henson wrote: > Yes, I am using a direct link between the two physical firewalls. [...] > Is this no longer a best practice?
If it's in the documentation, I suppose it still is. But I have found it problematic, because taking down one firewall, or even only its sync interface, will automatically demote the sync interface on the other one, which then will affect the whole carp group, if the interface is part of that group. When I first tried carp in the lab many, many years ago, I vaguely remember seeing effects similar to what you describe, and have used switched sync interfaces ever since.
