Pfsense Carp

                                                    CARP-SETUP-GIPL

(Before CARP Setup Layer 2 Switching Loop needs to be eliminated by making changes in the system files , configuration changes is located at bottom of this Doc

As we have already configured pfsense firewall, now we need to make another pfsense with exact same configurations, which will serve as backup server, in case of primary pfsense goes down or failure.

In order to build backup pfsense, we are going to first download whole Configuration Backup from primary pfsense

Reference :- https://doc.pfsense.org/index.php/Configuration_Backup_and_Restore

Diagnostics > Backup/Restore, and clicking Download Configuration.

Now keep this file in safe place in your local system.

Now we are going to create backup server, just install the pfsense on backup server (already described in previous document)

After Installation Connect one machine directly to LAN port of backup server and assign IP 192.168.1.2/24 (so that we can use GUI to restore backup)

Because by default pfsense will assign LAN IP as 192.168.1.1/24 to its LAN interface

Now from your Local Machine which is connected directly to pfsense LAN interface open this link:- https://192.168.1.1

It will load configuration panel of pfsense just skip it by clicking at the TOP of pfsense Picture on left side.

Now restoring a configuration is just as easy,

Diagnostics > Backup/Restore

Click Browse, locate the backup configuration file, and then click Restore Configuration.

Configuration files can be restored to a completely different piece of hardware without issue. If the new target hardware has different NICs

than the system where the backup was taken, a prompt will appear to re-assign the NICs after restoring the configuration

Now Wait For around 5 hours, this process will install all the packages with configurations.

Once the task is completed Change the IP’s as described in the Diagram, for wan, bridge and lan.

Now we have Two Machines Ready running Pfsense with same configurations (make sure you change the WAN, bridge, LAN IP’s on Backup Server) We are now going to Setup CARP:-

Reference:- https://doc.pfsense.org/index.php/Configuring_pfSense_Hardware_Redundancy_%28CARP%29

One real IP address is required for every CARP cluster node. To have 2 cluster nodes, 2 IP addresses are needed for the real interfaces and then an additional IP for each CARP type virtual IP address

On the primary cluster node, add a virtual IP addresses of the CARP type in Firewall > Virtual IPs. The virtual IP addresses must fall within the same subnet of an IP address defined on a real interface

A unique VHID must be used for each shared virtual IP address on a given interface (It is assigned automatically) Setup a Dedicated Sync Interface

Set up each cluster Sync interface; give it an IP address in the same subnet. on the primary cluster node enter 10.0.0.1 and on the secondary cluster node enter 10.0.0.2 for the IP address. Use a /24 subnet.

Add Firewall Rules for Synchronization

Before configuring synchronization, add firewall rules to the Sync interface that will pass traffic between the nodes. • Navigate to Firewall > Rules on the Sync interface tab

• Add a rule to pass traffic from the Sync Net to any destination.

Enable State Synchronization (pfsync)

State synchronization should be enabled on all cluster nodes.

• Navigate to System > High Avail. Sync

• Check Synchronize States

• Choose the correct Synchronize Interface for state synchronization

• If using two cluster nodes, enter the sync interface IP address for the opposing node in pfsync Synchronize Peer IP.

  the primary cluster node would have 10.0.0.2 set. The secondary node would have 10.0.0.1 set.

   Click Save 

Enable Configuration Synchronization (XMLRPC Sync)

Before proceeding, set the same admin user password and webConfigurator protocol (e.g. HTTPS) on each cluster node.

The configuration synchronization settings should only be enabled on the primary cluster node.

• Navigate to System > High Avail. Sync

• Enter the IP address of the secondary in Synchronize Config to IP 10.0.0.2

• Enter admin for the Remote System Username (other usernames will not work)

• Enter the Remote System Password (the password should be the same on all nodes)

• Check boxes for the desired configuration areas to sync

• Click Save The chosen areas will synchronize to the secondary node once the settings have been saved.

Now reboot both the machines 1 by 1

Verify CARP Status

On both nodes, check Status > CARP (failover). If either system shows a button labeled Enable CARP, click it. On that page, verify that the VIPs show the proper status. On the primary node, each VIP should show MASTER. On the secondary node, each VIP should show BACKUP.

Layer 2 Switching Loop Workaround:- The editor is available here: Diagnostics>Edit File. The Load/Save path is “/conf/config.xml”.

Look for these lines :-

1. CARP notify hooks. This will call carpup/carpdown with the
2. interface (carp0, carp1) as the first parameter.

notify 100 {

match "system"          "CARP";
  match "type"            "MASTER";
  action "/usr/local/sbin/pfSctl -c 'interface carpmaster $subsystem'";

}; notify 100 {

   match "system"          "CARP";
   match "type"            "BACKUP";
   action "/usr/local/sbin/pfSctl -c 'interface carpbackup $subsystem'";

};

Modify As:- notify 100 {

   match "system"          "CARP";
   match "type"            "MASTER";
   action "ifconfig bridge0 up && /usr/local/sbin/pfSctl -c 'interface carpmaster $subsystem'";

};

notify 100 {

   match "system"          "CARP";
   match "type"            "BACKUP";
   action "ifconfig bridge0 down && /usr/local/sbin/pfSctl -c 'interface carpbackup $subsystem'";

};

Save this file and reboot both servers 1 by 1. Make these changes before CARPSETUP.