pfSense

fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/496

Theory¶

It is in fact expected behavior that radvd is starting on both hosts. radvd is supposed to send RAs for a given interface iff the link-local address configured in AdvRASrcAddress is present on the interface.

Practice¶

This works well in Linux because Keepalived makes sure that the virtual link-local address is configured on one node only. In BSD/CARP however, a virtual CARP address is always configured on all nodes. It is just flaged with MASTER/BACKUP.

Regrettably radvd is not aware of the address flags in BSD. Thus, it will send RAs regardless of whether a link-local address is flagged with MASTER or BACKUP. I intended to report that upstream, but honestly forgot about it.

Summary¶

Thus, I agree that we need a workaround in pfSense until upstream radvd is patched to respect MASTER/BACKUP address flags on BSDs.

Upstream issue: https://github.com/radvd-project/radvd/issues/162