Training: High Availability

Netgate pfSense Plus Fundamentals — Section 10: High Availability

Overview

High Availability (HA) in pfSense uses an active/passive pair of firewalls to provide hardware redundancy. This architecture offers:

• Increased redundancy options
• Less painful upgrades
• Seamless failover capabilities

HA relies on three separate functions working together:

Function	Purpose
CARP	Provides redundant IP addresses (Virtual IPs) shared between HA members
pfSync	Synchronizes the state table between HA members for seamless failover
XMLRPC	Synchronizes configuration from the primary to secondary firewalls

CARP (Common Address Redundancy Protocol)

• Uses multicast for announcements
• Every CARP VIP has a unique VHID (Virtual Host ID)
• CARP VIP is shared between VHID members
• VHID groups are password protected
• At least 3 public IPs required per WAN
• WAN needs at least a /29 subnet

pfSync

• Syncs state table between the two HA members
• Enables seamless failover during an outage
• Can use multicast or unicast for updates
• No authentication for updates
• Likes a dedicated interface (recommended)

XMLRPC (Configuration Sync)

• Syncs configuration between HA members
• Syncs from primary to secondaries
• Only need to configure one firewall
• May not sync everything — packages are responsible for their own config sync

CARP Configuration Requirements

• At least one CARP VIP on WAN
• At least one CARP VIP on LAN
• Manual Outbound NAT to CARP VIP
• DHCP adjustments needed (use CARP VIP as default gateway)

Typical Topology

Single WAN

ISP1
  |
[ HA Pair ] — LAN

Multi-WAN

ISP1     ISP2
  |        |
[   HA Pair   ] — LAN

Common Failures

• Dual master on CARP VIPs
• Loss of active connections on failover
• Loss of connectivity on failover

Section 10 Summary

• Active/Passive pair
• Will need at least /29 of network space per WAN
• Use a unique VHID for every CARP VIP
• Use a separate private interface for pfSync data
• Packages are responsible for their own config sync
• Outbound NAT to CARP VIP
• DHCP adjusted for CARP VIP as default gateway

Next Module: Training Lab 10: High Availability — Hands-on Configuration and Failover Testing

Source Attribution

• Netgate pfSense Plus Fundamentals and Practical Application
• © 2017–2021 Rubicon Communications, LLC (Netgate)
• Source PDF: FUND001-LIVE-SLIDE-SEG10-HA.pdf