Configuring pfSense High Availability with CARP for Active‑Passive Failover

Desired Outcome

You want two pfSense firewalls to operate as an active‑passive pair so that if the primary unit fails, the secondary automatically takes over traffic for the same IP addresses without manual reconfiguration.

Prerequisites

• Both firewalls run the same pfSense version (e.g., 2.7.0).
• Interface names match exactly on each unit (e.g., WAN = igb0, LAN = igb1, SYNC = igb2).
• A dedicated sync interface that is not used for any other traffic and resides on a private subnet (e.g., 169.254.100.0/30).
• Administrative access (SSD or console) with permission to modify System → High Availability Sync and interface settings.
• No other VRRP, CARP, or HAProxy instances running on the same interfaces.

Procedure

1. Configure the sync interface

   On each firewall, assign a static IP to the sync interface:

   • Primary: 169.254.100.1/30
   • Secondary: 169.254.100.2/30

   Navigate to Interfaces → [sync interface], set the IP address, and leave the gateway blank.

2. Enable CARP on data interfaces

   For each interface that must fail over (WAN, LAN, etc.):

   1. Go to Interfaces → [interface] → Virtual IPs and add a CARP type.
   2. Enter a Virtual IP (VIP) from your existing subnet (e.g., WAN VIP 203.0.113.10/24, LAN VIP 10.0.0.1/24).
   3. Set a Password that matches on both firewalls.
   4. Set AdvSkew: 0 on the primary, 100 on the secondary (higher value = lower priority).
   5. Save and apply changes.

3. Configure High Availability Sync

   On the primary firewall:

   • Navigate to System → High Availability Sync.
   • Set the Synchronize to IP to the secondary’s sync interface IP (169.254.100.2).
   • Enter the Remote Username and Password** (an admin account on the secondary).
   • Check the boxes for the configuration sections you want to replicate (typically All or at least Filter, NAT, VPN, DHCP).
   • Set the Synchronize Interval to 1 minute (default).
   • Save.

   Repeat the same steps on the secondary, pointing the Synchronize to IP to the primary’s sync interface (169.254.100.1). This creates bidirectional XMLRPC sync, but note that only the primary pushes changes; the secondary remains a passive consumer.

4. Verify CARP operation

   On each firewall, check Status → CARP:

   • Primary should show MASTER with AdvSkew 0 for each VIP.
   • Secondary should show BACKUP with AdvSkew 100.
   • Both nodes list the same VIP addresses.

   From an external host, ping each CARP VIP (e.g., ping 203.0.113.10) to confirm reachability.

5. Test failover

   Power off or disconnect the primary firewall’s power/network.

   • Observe the secondary’s CARP status change to MASTER for all VIPs.
   • Verify that the VIPs remain pingable from the external host.

   Restore the primary. With preempt disabled (default), it will return to BACKUP and continue to receive config sync; with preempt enabled it will regain MASTER.

Expected Checks

• Status → CARP shows correct MASTER/BACKUP roles and identical VIP lists.
• Ping to each CARP VIP succeeds before and after failover.
• System → High Availability Sync shows successful XMLRPC pushes (last sync timestamp updates).

Recovery Options

• If the secondary fails to take over, check that the sync interface is still up and that CARP multicast (224.0.0.18) is not blocked by any upstream switch or firewall rule.
• To revert to a single‑node configuration, disable CARP on each interface (Interfaces → [interface] → Virtual IPs → delete the CARP VIP) and disable HA Sync.

Limitations and Practical Verification

CARP only works within the same broadcast domain; it cannot span routers. Ensure that the sync interface uses a subnet that is not duplicated elsewhere to avoid VIP conflicts. After any change, re‑check the CARP status and ping the VIPs as described above to confirm the configuration is active.