<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hi,<br>
<br>
You could try to add "
<meta http-equiv="content-type" content="text/html;
charset=windows-1252">
net.inet.carp.drop_echoed=1" to pfsense in /etc/sysctl.conf ?<br>
<br>
It is an old fix for VMWare and FreeBSD. I am not able to test it at
the moment but I can see it's not in the config of the latest
version of PFSense.<br>
<br>
Maybe this will help?<br>
<br>
<a class="moz-txt-link-freetext" href="https://doc.pfsense.org/index.php/CARP_Configuration_Troubleshooting">https://doc.pfsense.org/index.php/CARP_Configuration_Troubleshooting</a><br>
<blockquote>
<meta http-equiv="content-type" content="text/html;
charset=windows-1252">
<h4 style="color: black; font-weight: bold; margin: 0px 0px 0.3em;
padding-top: 0.5em; padding-bottom: 0.17em; border-bottom-style:
none; font-size: 14.732px; font-family: sans-serif; font-style:
normal; font-variant: normal; letter-spacing: normal;
line-height: 19.05px; orphans: auto; text-align: start;
text-indent: 0px; text-transform: none; white-space: normal;
widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px;
background: none;"><span class="mw-headline"
id="Client_Port_Issues">Client Port Issues</span></h4>
<p style="margin: 0.4em 0px 0.5em; line-height: 19.05px; color:
rgb(85, 85, 85); font-family: sans-serif; font-size: 12.7px;
font-style: normal; font-variant: normal; font-weight: normal;
letter-spacing: normal; orphans: auto; text-align: start;
text-indent: 0px; text-transform: none; white-space: normal;
widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px;">If
a physical CARP cluster is connected to a switch with an ESX box
using multiple ports on the ESX box (lagg group or similar), and
only certain devices/IPs are reachable by the target VM, then
the port group settings in ESX may need adjusted to set the load
balancing for the group to hash based on IP, not the originating
interface.</p>
<p style="margin: 0.4em 0px 0.5em; line-height: 19.05px; color:
rgb(85, 85, 85); font-family: sans-serif; font-size: 12.7px;
font-style: normal; font-variant: normal; font-weight: normal;
letter-spacing: normal; orphans: auto; text-align: start;
text-indent: 0px; text-transform: none; white-space: normal;
widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px;">Side
effects of having that set incorrectly include:</p>
<ul style="line-height: 19.05px; list-style-type: square; margin:
0.3em 0px 0px 1.6em; padding: 0px; list-style-image:
url("bullet.gif"); color: rgb(85, 85, 85);
font-family: sans-serif; font-size: 12.7px; font-style: normal;
font-variant: normal; font-weight: normal; letter-spacing:
normal; orphans: auto; text-align: start; text-indent: 0px;
text-transform: none; white-space: normal; widows: 1;
word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<li style="margin-bottom: 0.1em;">Traffic only reaching the
target VM in promisc mode on its NIC</li>
<li style="margin-bottom: 0.1em;">Inability to reach the CARP IP
from the target VM when the "real" IP of the primary firewall
is reachable</li>
<li style="margin-bottom: 0.1em;">Port forwards or other inbound
connections to the target VM work from some IPs and not
others.</li>
</ul>
<br class="Apple-interchange-newline">
</blockquote>
<br>
<br>
<br>
<br>
<meta http-equiv="content-type" content="text/html;
charset=windows-1252">
<div class="moz-cite-prefix">On 07/13/2016 03:59 PM, Matt . wrote:<br>
</div>
<blockquote
cite="mid:CAPNQp06UMTC5HJtbbCAno1-dvy1B-8BiagffRGM9WCdWNGzz4Q@mail.gmail.com"
type="cite">
<pre wrap="">As addition: I get the same result using mode=4, only when I use
multiple VLANS on the interface.
2016-07-13 15:58 GMT+02:00 Matt . <a class="moz-txt-link-rfc2396E" href="mailto:yamakasi.014@gmail.com"><yamakasi.014@gmail.com></a>:
</pre>
<blockquote type="cite">
<pre wrap="">Hi Pavel,
Thanks for your update. I also saw that the post are both online but I
thought the second nic only advertises the mac so the switch does not
get confused.
The issue might be that i do VRRP, so the bond is connected to two
switches, they are not stacked, only trunked as that's what VRRP
requires and works well on the side where there is only one VLAN on
the Host interface.
It just goes wrong on multiple vlans.
This is what I see everywhere.
Mode 1 (active-backup)
This mode places one of the interfaces into a backup state and will
only make it active if the link is lost by the active interface. Only
one slave in the bond is active at an instance of time. A different
slave becomes active only when the active slave fails. This mode
provides fault tolerance.
It's sure I need to get my traffic back on my sending port, so that is
why the arp for the passive port was there I thought.
Are there other modes that should be working on VRRP in your understanding ?
Thanks a lot,
Matt
2016-07-13 15:43 GMT+02:00 Pavel Gashev <a class="moz-txt-link-rfc2396E" href="mailto:Pax@acronis.com"><Pax@acronis.com></a>:
</pre>
<blockquote type="cite">
<pre wrap="">In mode=1 the active interface sends traffic, but both interfaces accept incoming traffic. Hardware switches send broadcast/multicast/unknown destination MACs to all ports, including the passive interface. So packet sent from the active interface can be received back from the passive interface. FreeBSD CARP just would go mad when it receives its own packets.
I believe if you get Linux implementation, it will work well in the same network setup. I use keepalived in oVirt VMs with bonded network, and have no issues.
-----Original Message-----
From: "Matt ." <a class="moz-txt-link-rfc2396E" href="mailto:yamakasi.014@gmail.com"><yamakasi.014@gmail.com></a>
Date: Wednesday 13 July 2016 at 15:54
To: Pavel Gashev <a class="moz-txt-link-rfc2396E" href="mailto:Pax@acronis.com"><Pax@acronis.com></a>, users <a class="moz-txt-link-rfc2396E" href="mailto:users@ovirt.org"><users@ovirt.org></a>
Subject: Re: [ovirt-users] CARP Fails on Bond mode=1
How can it lead into packet duplication when the passive should not be
active and only it's mac-address should be visible on the switch to
prevent confusion on the switch ?
For a VRRP setup on the switch there is no other option then mode=1 as
far as I know ?
2016-07-13 14:50 GMT+02:00 Pavel Gashev <a class="moz-txt-link-rfc2396E" href="mailto:Pax@acronis.com"><Pax@acronis.com></a>:
</pre>
<blockquote type="cite">
<pre wrap="">I would say that bonding breaks CARP somehow. In example mode=1 can lead to packet duplication, so pfsense can receive it's own packets. Try firewall in pfsense all incomming packets that have the same source MAC address as pfsense.
-----Original Message-----
From: "Matt ." <a class="moz-txt-link-rfc2396E" href="mailto:yamakasi.014@gmail.com"><yamakasi.014@gmail.com></a>
Date: Wednesday 13 July 2016 at 15:29
To: Pavel Gashev <a class="moz-txt-link-rfc2396E" href="mailto:Pax@acronis.com"><Pax@acronis.com></a>
Subject: Re: [ovirt-users] CARP Fails on Bond mode=1
Hi Pavel,
No it's Pfsense, so FreeBSD.
Is there something different there ?
2016-07-13 13:59 GMT+02:00 Pavel Gashev <a class="moz-txt-link-rfc2396E" href="mailto:Pax@acronis.com"><Pax@acronis.com></a>:
</pre>
<blockquote type="cite">
<pre wrap="">Matt,
How is CARP implemented? Is it OpenBSD?
-----Original Message-----
From: <a class="moz-txt-link-rfc2396E" href="mailto:users-bounces@ovirt.org"><users-bounces@ovirt.org></a> on behalf of "Matt ." <a class="moz-txt-link-rfc2396E" href="mailto:yamakasi.014@gmail.com"><yamakasi.014@gmail.com></a>
Date: Wednesday 13 July 2016 at 12:42
Cc: users <a class="moz-txt-link-rfc2396E" href="mailto:users@ovirt.org"><users@ovirt.org></a>
Subject: Re: [ovirt-users] CARP Fails on Bond mode=1
Hi Pavel,
This is done and used without the Bond before.
Now I applied a bond it goes wrong and I'm searching but can't find a
thing about it.
2016-07-13 11:03 GMT+02:00 Pavel Gashev <a class="moz-txt-link-rfc2396E" href="mailto:Pax@acronis.com"><Pax@acronis.com></a>:
</pre>
<blockquote type="cite">
<pre wrap="">Matt,
In order to use CARP/VRRP in a VM you have to disable MAC spoofing prevention.
<a class="moz-txt-link-freetext" href="http://lists.ovirt.org/pipermail/users/2015-May/032839.html">http://lists.ovirt.org/pipermail/users/2015-May/032839.html</a>
-----Original Message-----
From: <a class="moz-txt-link-rfc2396E" href="mailto:users-bounces@ovirt.org"><users-bounces@ovirt.org></a> on behalf of "Matt ." <a class="moz-txt-link-rfc2396E" href="mailto:yamakasi.014@gmail.com"><yamakasi.014@gmail.com></a>
Date: Tuesday 12 July 2016 at 21:58
To: users <a class="moz-txt-link-rfc2396E" href="mailto:users@ovirt.org"><users@ovirt.org></a>
Subject: [ovirt-users] CARP Fails on Bond mode=1
Hi guys,
I have been testing bonding with a vm connected to the network on this
bond mode=1 (vlans on top of it) where the vm uses a carp IP for
failover.
It seems that when the VM which holds the Carp IP and so is Master you
can ping both IP's, so interface IP and Carp IP, but you cannot
throw/route any traffic over it.
You can route traffic over the interface IP of the Carp Slave.
Is this known or just not possible ?
I hope it's a "bug" :)
Thanks,
Matt
_______________________________________________
Users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Users@ovirt.org">Users@ovirt.org</a>
<a class="moz-txt-link-freetext" href="http://lists.ovirt.org/mailman/listinfo/users">http://lists.ovirt.org/mailman/listinfo/users</a>
</pre>
</blockquote>
<pre wrap="">_______________________________________________
Users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Users@ovirt.org">Users@ovirt.org</a>
<a class="moz-txt-link-freetext" href="http://lists.ovirt.org/mailman/listinfo/users">http://lists.ovirt.org/mailman/listinfo/users</a>
</pre>
</blockquote>
<pre wrap="">
</pre>
</blockquote>
<pre wrap="">
</pre>
</blockquote>
</blockquote>
<pre wrap="">_______________________________________________
Users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Users@ovirt.org">Users@ovirt.org</a>
<a class="moz-txt-link-freetext" href="http://lists.ovirt.org/mailman/listinfo/users">http://lists.ovirt.org/mailman/listinfo/users</a>
</pre>
</blockquote>
<br>
<BR />
<BR />
<b style="color:#604c78"></b><br><br><span style="color:#604c78;"><font color="000000"><span style="mso-fareast-language:en-gb;" lang="NL">Met vriendelijke groet, With kind regards,<br><br>Jorick Astrego<br></span></font></span><b style="color:#604c78"><br>Netbulae Virtualization Experts </b><br><hr style="border:none;border-top:1px solid #ccc;"><table style="width: 522px"><tbody><tr><td style="width: 130px;font-size: 10px">Tel: 053 20 30 270</td> <td style="width: 130px;font-size: 10px">info@netbulae.eu</td> <td style="width: 130px;font-size: 10px">Staalsteden 4-3A</td> <td style="width: 130px;font-size: 10px">KvK 08198180</td></tr><tr> <td style="width: 130px;font-size: 10px">Fax: 053 20 30 271</td> <td style="width: 130px;font-size: 10px">www.netbulae.eu</td> <td style="width: 130px;font-size: 10px">7547 TA Enschede</td> <td style="width: 130px;font-size: 10px">BTW NL821234584B01</td></tr></tbody></table><br><hr style="border:none;border-top:1px solid #ccc;"><BR />
</body>
</html>