Regression #14026
closed
HA node with CARP VIP in backup state is unable to ping the active node using that CARP VIP address
Added by Christopher Cope over 1 year ago.
Updated about 1 month ago.
Plus Target Version:
24.11
Description
This was brought up by a customer and I am able to reproduce it.
Master 10.41.1.252
Backup 10.40.1.253
CARP 10.40.1.254
10.40.1.253 is unable to ping 10.40.1.254 on 23.01, but is able to on a 22.05 install.
When pinging 10.40.1.253 > 10.40.1.254 and using packet capture it shows packets reaching 10.41.1.252 and replies making it back to 10.41.1.253, but ping never sees the response. There are no blocked entries in the firewall logs.
For reference:
This is due to source validation which is now being enabled by default. To return the previous behavior, set net.inet.ip.source_address_validation
and net.inet6.ip6.source_address_validation
to 0
.
ref: IPv4 commit , IPv6 commit
- Related to Feature #11369: add Enabling IPv6 Source Address Validation support added
- Has duplicate Bug #14798: can't ping VIP addresses from the secondary node added
- Subject changed from CARP backup is unable to ping master via CARP IP. to CARP backup node is unable to ping master node CARP VIP address
Marcos - similar to IPsec VTI and the strict policy, should we carve out an exception for this?
- Status changed from New to Resolved
- Target version set to 2.8.0
- Plus Target Version set to 24.08
The upcoming pfSense software release includes the upstream patch and the ping works as expected there.
The fix seems to work for IPv4 but not IPv6. With IPv6 the secondary still can't ping the CARP VIP, both for GUA and LL type addresses. Though setting net.inet6.ip6.source_address_validation=0
doesn't help there either so maybe there is something else going on.
- Subject changed from CARP backup node is unable to ping master node CARP VIP address to HA node with CARP VIP in backup state is unable to ping the active node using that CARP VIP address
- Plus Target Version changed from 24.08 to 24.11
Also available in: Atom
PDF