Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have 2 OpenBSD computers set up as firewalls between my network and the Internet. On the local network, fw1 has IP 192.168.0.253, and fw2 has IP 192.168.0.254, and they share 192.168.0.1 using CARP. On the WAN, they have IPs 192.168.1.253 and 192.168.1.254, and share 172.16.0.1 (the real IP is a public IP). I have it set up like this in order to save public IPs; I don't have enough to give each firewall its own IP and use CARP on a third.

However, CARP doesn't seem to be working right. When I demote fw1, the internal CARP device switches to backup mode. However, the external interface stays in master mode. Oddly, fw2 also goes to master mode when I demote fw1, so there are 2 masters.

Any idea why that interface doesn't go to backup mode?

share|improve this question

1 Answer 1

The default behavior of CARP is to treat interfaces independently, so you can have one master and another slave interface in the same box.

To change this behavior, you have to change preempt flag to 1:

sysctl net.inet.carp.preempt=1

Here is an except from OpenBSD's FAQ:

net.inet.carp.preempt

Allow hosts within a redundancy group that have a better advbase and advskew to preempt the master. In addition, this option also enables failing over a group of interfaces together in the event that one interface goes down. If one physical CARP-enabled interface goes down, CARP will increase the demotion counter, carpdemote, by 1 on interface groups that the carp(4) interface is a member of, in effect causing all group members to fail-over together. net.inet.carp.preempt is 0 (disabled) by default.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.