pfSense High Availability Setup Guide

Welcome to Artiste1.com Guide on setting up High Availability (HA) with pfSense.
The process of configuring a pfSense HA cluster to ensure maximum uptime for your network.

1. Introduction to pfSense High Availability

High Availability in pfSense uses the Common Address Redundancy Protocol (CARP) to create a cluster of two or more firewalls. This setup provides redundancy and failover capabilities, ensuring that your network remains operational even if one firewall fails.

1.1 Components of pfSense HA

2. Prerequisites

3. Network Topology

Here's a basic network topology for a pfSense HA setup:

         +------------+
         |            |
         |  Internet  |
         |            |
         +-----+------+
               |
         +-----+------+
         |            |
    +----+ HA Cluster +----+
    |    |            |    |
    |    +------------+    |
    |                      |
+---+---+              +---+---+
|       |              |       |
| pf1   |              | pf2   |
|       |              |       |
+---+---+              +---+---+
    |                      |
    |    +------------+    |
    |    |            |    |
    +----+    LAN     +----+
         |            |
         +------------+

4. Initial Configuration

4.1 Configure the Primary Node

  1. Install pfSense on both systems
  2. Configure the WAN and LAN interfaces on the primary node
  3. Set up the Sync interface:
    • Go to Interfaces > Assignments
    • Add a new interface for Sync (e.g., OPT1)
    • Set a static IP (e.g., 172.16.1.1/24) for the Sync interface

4.2 Configure the Secondary Node

  1. Configure the WAN and LAN interfaces with the same subnet as the primary node
  2. Set up the Sync interface with a different IP in the same subnet (e.g., 172.16.1.2/24)

5. Setting up CARP

5.1 Enable CARP

  1. On both nodes, go to System > High Avail. Sync
  2. Check "Synchronize States"
  3. Set the Synchronize Interface to your Sync interface
  4. Set a strong password for synchronization

5.2 Configure CARP Virtual IPs

  1. On the primary node, go to Firewall > Virtual IPs
  2. Add a new Virtual IP:
    • Type: CARP
    • Interface: WAN
    • Address: Your public IP
    • Virtual IP Password: Set a strong password
    • VHID Group: 1 (for WAN)
    • Advertising Frequency: 1
  3. Repeat for LAN interface with a different VHID (e.g., 2)

5.3 Configure pfsync

  1. On both nodes, go to System > High Avail. Sync
  2. Enable pfsync synchronization
  3. Set pfsync Synchronize Peer IP to the other node's Sync IP

6. Configuration Synchronization

6.1 Set up XML-RPC Config Sync

  1. On the primary node, go to System > High Avail. Sync
  2. Check "Synchronize Config to IP"
  3. Enter the secondary node's Sync IP
  4. Set the Remote System Username and Password

6.2 Synchronize for the First Time

  1. On the primary node, go to Diagnostics > Backup & Restore
  2. Click "Download configuration as XML"
  3. On the secondary node, restore this configuration

7. Testing and Verification

7.1 Verify CARP Status

  1. On both nodes, go to Status > CARP (failover)
  2. Ensure CARP status is MASTER on the primary and BACKUP on the secondary

7.2 Test Failover

  1. Disconnect the primary node's WAN interface
  2. Verify that the secondary node becomes MASTER
  3. Reconnect the primary node and ensure it becomes MASTER again

8. Advanced Configuration

8.1 Load Balancing

You can set up load balancing by configuring multiple CARP groups with different priorities:

Node 1: WAN VHID 1 (prio 254), LAN VHID 2 (prio 254), OPT1 VHID 3 (prio 100)
Node 2: WAN VHID 1 (prio 100), LAN VHID 2 (prio 100), OPT1 VHID 3 (prio 254)

8.2 Monitoring and Alerts

Set up monitoring and alerts to be notified of failover events:

  1. Go to Status > Notifications
  2. Configure email or other notification methods
  3. Enable notifications for CARP status changes

9. Troubleshooting

Issue Possible Solution
CARP not syncing Check firewall rules, ensure CARP traffic is allowed
Config not syncing Verify XML-RPC settings, check credentials
Frequent failovers Check network stability, adjust advertising frequency

Conclusion

Congratulations! You've now set up a High Availability cluster with pfSense.
This setup provides redundancy and ensures minimal downtime for your network.
Remember to regularly test your failover setup and keep your pfSense installations updated.

Note: High Availability setups can be complex. Always test thoroughly in a non-production environment before implementing in a live network.

For more advanced pfSense topics, check out our other guides:






Scroll to Top