Well....I did find something here....

At first, I couldn't get any traffic to pass down the tunnel until I added a rule:

Interface:  IPSEC
Proto:  any
Source:  (remote LAN)
Dest:  (local LAN)

I didn't have to put that in for single FW to single FW.  Can you think of any reason I need it now or was I just lucky that it worked before?

One other thing to note:  When I do a tracert, if the trace fails, I get a response from the REAL Ip on the master, not from the CARP interface.  Am I nuts, have it totally misconfigured my firewalls or something else entirely?

Thanks for any input!
Scott

-----Original Message-----
From: sullrich [mailto:sullrich@gmail.com] 
Sent: Wednesday, February 14, 2007 4:09 PM
To: support
Subject: Re: [pfSense Support] CARP+IPSEC

On 2/14/07, Scott Ullrich <sullrich@gmail.com> wrote:
> Here's a short howto.
>
> #1. Setup your tunnels to use "IP address" and the VIP carp member #2. 
> Visit Vpn, IPSEC, Failover IPSEC, define the VIP ip address #3. Visit 
> the other end of the tunnel, make sure the remote gateway is set as 
> the CARP VIP #4. There is no step 3.  Enjoy your failover IPSEC.

#4. There is no step 4.  Enjoy your failover IPSEC.

Oops, got ahead of myself.

Scott

---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe@pfsense.com
For additional commands, e-mail: support-help@pfsense.com