Mike Barnard <mike.barna...@gmail.com> wrote: > > FW1 is connected to SW1 and FW2 is connected to SW2. Both SW1 and SW2 > connected to the aggregating switch. > > I have configured CARP in failover mode and the interesting thing is both > firewall carp interfaces come up as master: > > FW1: > carp0: flags=49<UP,LOOPBACK,RUNNING> metric 0 mtu 1500 > inet 41.xxx.yyy.243 netmask 0xfffffff8 > carp: MASTER vhid 1 advbase 1 advskew 1 > carp1: flags=49<UP,LOOPBACK,RUNNING> metric 0 mtu 1500 > inet 41.xxx.yyy.251 netmask 0xfffffff8 > carp: MASTER vhid 2 advbase 1 advskew 1 > > FW2: > carp0: flags=49<UP,LOOPBACK,RUNNING> metric 0 mtu 1500 > inet 41.xxx.yyy.243 netmask 0xfffffff8 > carp: MASTER vhid 1 advbase 1 advskew 100 > carp1: flags=49<UP,LOOPBACK,RUNNING> metric 0 mtu 1500 > inet 41.xxx.yyy.251 netmask 0xfffffff8 > carp: MASTER vhid 2 advbase 1 advskew 100
The two firewalls cannot hear each other's CARP announcements. Test with tcpdump; do you see the CARP packets coming from the other firewall? If not, you have a switching problem, like the two firewalls are not in the same VLAN together. If you do see the packets arriving, it probably means that your PF policy is blocking CARP from your neighbor. -- David DeSimone == Network Admin == f...@verio.net "I don't like spinach, and I'm glad I don't, because if I liked it I'd eat it, and I just hate it." -- Clarence Darrow This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio, Inc. makes no warranty that this email is error or virus free. Thank you. _______________________________________________ freebsd-net@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org"
