[SOLVED] PVE 7.3 - PFSENSE HA - BOTH MASTER

[Cedimas]

Hello everyone,

I am having a problem with a pfsense CARP infrastructure under proxmox. Both of my pfsenses are both masters and I am tearing my hair out.

Here is my infrastructure:

• Physical ==> 2 servers rented from SCALEWAY
• Virtualization ==> proxmox 7.3
• Pfsense ==> 2.6 - I have a WAN + LAN + CARP interface on each server

What I have tried:

• Putting all of my interfaces in promiscuous mode ==> KO
• Completely rebuilding the infrastructure ==> KO
• Reinstalling the PFSENSE ==> KO
• Reading the tcpdump ==> No information, not really content.

I had set up the pfsense CARP on the same physical machines but under VMWARE and everything was OK.
I followed the recommendations at this link: https://docs.netgate.com/pfsense/en/latest/troubleshooting/high-availability-virtual.html

That is why I am posting my request on this site today because I think it is coming from PROXMOX.

Can you help me? Thank you.

 

[mr44er]

The multicast traffic fails, if you have non-LACP bonds like balance-slb. Is this the case?
The solutions here are the same: https://portal.nutanix.com/page/documents/kbs/details?targetId=kA00e000000LKCtCAO

 

[Cedimas]

Hello mr44er

I don't have bond ports, only bridge interfaces.
I don't understand, do I need to enable icmp snooping?

Thank you for your help.

 

[mr44er]

If you don't have bonds, then it's something other.
I have OPNsense with CARP running on LACP bonds and this works, problems only on non-LACP bonds, but this has nothing to do with proxmox.

Maybe you should ask the question also on the pfsense-forum.

 

[Cedimas]

I wrote on the netgate forum:
https://forum.netgate.com/topic/176879/pfsense-ha-both-master-proxmox

But for the moment no answer.

But what is strange is that on VMWARE it works but not on PROXMOX, as if I forgot a parameter to activate or deactivate.

There is no notion like on VMWARE to enable :

• Enable MAC Address changes
• Enable Forged transmits
• Enable promiscuous mode on the vSwitch

Thanks for your feedback

 

[Cedimas]

Hello to all,

Problem solved.

As I use the SCALEWAY RPN network, the PFSYNC network had to be separated from the other network.

I have specified a vlan on each interface (see photo):
200 ==> PFSYNC
202 ==> LAN
2022 ==> CLUSTER



Thx