[SOLVED] Proxmox + Pfsense CARP not working

[onggsteph]

Hello,

I am trying to configure a HA with 2 Pfsense VMs hosted on 2 physical proxmox servers.

Everything works well, excepted I am facing a problem to configure a public CARP IP on Pfsense VMs. Every public CARP IP created can not be accessed outside Pfsense network. Then both Pfsense VM are seeing as Master on the WAN interface (instead of Master/Backup).

While troubleshooting on Proxmox I were not able to see any multicast packets and we noticed also that Pfsense could not be able to create an ARP entry of that CARP IP.

Proxmox eth0 and vmbr0 (wan interface) are set on promiscuous mode. I've also disabled the multicast snooping. But still nothing works.

You will find attached the architecture in place

Any assistance is welcome

Proxmox installation
root@DECSLDPHYPPMX01:~# pveversion --verbose
proxmox-ve: 6.1-2 (running kernel: 5.3.13-2-pve)
pve-manager: 6.1-5 (running version: 6.1-5/9bf06119)
pve-kernel-5.3: 6.1-2
pve-kernel-helper: 6.1-2
pve-kernel-4.15: 5.4-12
pve-kernel-5.3.13-2-pve: 5.3.13-2
pve-kernel-4.15.18-24-pve: 4.15.18-52
pve-kernel-4.15.18-12-pve: 4.15.18-36
ceph-fuse: 12.2.11+dfsg1-2.1+b1
corosync: 3.0.2-pve4
criu: 3.11-3
glusterfs-client: 5.5-3
ifupdown: residual config
ifupdown2: 3.0.0-1+pve2
ksm-control-daemon: 1.3-1
libjs-extjs: 6.0.1-10
libknet1: 1.13-pve1
libpve-access-control: 6.0-5
libpve-apiclient-perl: 3.0-2
libpve-common-perl: 6.1-3
libpve-guest-common-perl: 3.0-3
libpve-http-server-perl: 3.0-3
libpve-storage-perl: 6.1-3
libqb0: 1.0.5-1
libspice-server1: 0.14.2-4~pve6+1
lvm2: 2.03.02-pve3
lxc-pve: 3.2.1-1
lxcfs: 3.0.3-pve60
novnc-pve: 1.1.0-1
openvswitch-switch: 2.10.0+2018.08.28+git.8ca7c82b7d+ds1-12+deb10u2
proxmox-mini-journalreader: 1.1-1
proxmox-widget-toolkit: 2.1-2
pve-cluster: 6.1-3
pve-container: 3.0-18
pve-docs: 6.1-3
pve-edk2-firmware: 2.20191127-1
pve-firewall: 4.0-9
pve-firmware: 3.0-4
pve-ha-manager: 3.0-8
pve-i18n: 2.0-3
pve-qemu-kvm: 4.1.1-2
pve-xtermjs: 4.3.0-1
qemu-server: 6.1-4
smartmontools: 7.1-pve2
spiceterm: 3.1-1
vncterm: 1.6-1
zfsutils-linux: 0.8.3-pve1



best regards
Stephane

 

[guletz]

While troubleshooting on Proxmox I were not able to see any multicast packets and we noticed also that Pfsense could not be able to create an ARP entry of that CARP IP.

Hi,

I do not know Pfsense, but I know ucarp implementation on linux (is a fork from bsd if I remember). I use a centos CT with ucarp for some time in PMX 5 and now 6.x. The other ucarp is running on host outside of PMX ona bare-metal server. During this time ucarp have working on this CT without any problem. So I can only guess that could maybe be only a firewall problem in your case!

Good luck / Bafta !

 

[onggsteph]

hi,

Thank you for your hint. Indeed it helps me focusing only on the firewall and I fixed the problem by enabling promiscuous on wan interface (ifconfig vtnet0 promisc)

Regards