pfSense

Hi Pierre,

I just tested it and the config sync no longer removes the alias vips on the slave, but there's a catch.
When I change something on the master and it performs the config sync, the alias vips on the slave end up at the bottom of the VIP list, they become the last VIPs.

The problem is that when I reboot the slave, the CARP VIPs that depend on those aliases don't get configured properly, because at that point the aliases are not yet configured, so those interfaces become invalid and the failover doesn't work.

Here is what my ifconfig shows after the reboot:

vip21: flags=9<UP,LOOPBACK> metric 0 mtu 1500
carp: INIT vhid 21 advbase 1 advskew 100
vip22: flags=9<UP,LOOPBACK> metric 0 mtu 1500
carp: INIT vhid 22 advbase 1 advskew 100

They don't get the IP that was supposed to be assigned to them.

So I guess the alias VIPs on the slave should be kept at the beginning of the list, before the carp vips.
I've manually edited the config to change the order and it solved the problem.

Regards,
Thiago

Here I made the following change and it seems to be working fine:

--- /usr/local/www/xmlrpc.php   2010-10-27 12:51:33.000000000 -0200
+++ /tmp/xmlrpc.php     2010-10-27 12:51:03.000000000 -0200
@@ -169,7 +169,7 @@
         // Then add ipalias and proxyarp types already defined on the backup
         foreach ($vipbackup as $vip)
                 if (($vip['mode'] == 'ipalias') || ($vip['mode'] == 'proxyarp'))
-                        $config['virtualip']['vip'][] = $vip ;
+                        array_unshift($config['virtualip']['vip'], $vip);
        $mergedkeys = implode(",", array_keys($params[0]));
        write_config(sprintf(gettext("Merged in config (%s sections) from XMLRPC client."),$mergedkeys));
        interfaces_vips_configure();

Thanks for the feedback.

I do not know if you should apply any "sorting" on the VIP array on the backup firewall. With my code, "ipalias" and "proxyarp" VIP are at added at the end on the list, and with your patch, at the beginning. Both cases may be wrong, because:
- In the GUI, VIP list may not appear in the same order in the master and the backup.
- Internally in the code, I do know if this may have an impact (for fw rules for examples), or in screens on which there is a dropdown list with all VIP's type (OpenVPN for example).

For the dev team: any suggestion ?

Pierre

Hi Thiago,

I finally added your suggestion, everything is ok on my pair of boxes

Revision 00752d5a82baea1f05c8dcfdff58112b1d42620e

Can you also confirm this is ok ?

Regards,
Pierre