2

I'm setting up a High Availability Cluster with two pfSense SG-4860 routers. I have a question about setting up the network. Here is the diagram they provide:

enter image description here

I have a question about the WAN part. One of their prerequisites is:

  • A High Availability cluster needs three IP addresses in each subnet along with a separate unused subnet for the Sync interface. For WANs, this means that a /29 subnet or larger is required for an optimal configuration.

My question is: does this mean I need three external IP addresses from my ISP, or is it possible to do these internally with one external IP address from the ISP? Which would provide the best solution? I guess I'm just confused when it comes to this part of the network. Any feedback would be appreciated.

Edit:

I found this link on Super User: Can an ISP provide two static IPs over a single cable? Is this generally the way a network handles more than one IP address from an ISP?

Improve this question

2 Answers 2

Reset to default
1

The requirement is that each router have its own IP address (that's two), and there needs to be a virtual IP address (that makes three). If you are doing this on the public side, you will need three public addresses from your ISP, and that will require a maximum mask length of /29 since /30 will only give you two usable addresses.

I'm not sure what you mean by, "routing these to the switch," since switches don't know anything about IP addresses or routing.

Improve this answer
7
  • The part where i'm having a problem understanding is how to use more than one IP address from an ISP. Is this something that i need to setup equipment for? or does the ISP provide this and i just plug in a switch and have access to the IP address? i guess the "WAN mask /29" confuses me. I don't know if i need to set this up, or not.
    – Todd Matthews
    Mar 30, 2016 at 15:08
  • You must request such a network from your ISP ($$$). After you get it, you assign each router one of the addresses in the network, and you configure the cluster to have another for its virtual address.
    – Ron Maupin ♦
    Mar 30, 2016 at 15:11
  • is this generally expensive?
    – Todd Matthews
    Mar 30, 2016 at 15:42
  • It gets more expensive every day since the RIRs ran out of IPv4 addresses to assign to the ISPs. The ISPs are resorting to CGN for residential users in order to preserve their precious hoards of public IPv4 addresses for the business users who will pay for them. What it costs depends on your ISP.
    – Ron Maupin ♦
    Mar 30, 2016 at 15:46
  • I see, what goes into doing this on our own network instead of the ISP?
    – Todd Matthews
    Mar 30, 2016 at 16:27
1

THIS ONLY USES A SINGLE STATIC IP FROM MY ISP.

What I did was, I simply setup my pfSense, behind my first router/firewall. So, ISP <----> Modem <----> EdgeRouter-X (WAN PORT-DHCP to ISP) <---> Pfsense Server in Cluster (DHCP Reserved lease to EdgeRouter).

Edge Firewall (EdgeRouter-X) WAN: DHCP to ISP LAN: 192.168.50.0/24 DHCP Server: 192.168.50.100 - 192.168.50.200

PFSENSE-1 Pfsense-1 WAN-DHCP: 192.168.50.1 Pfsense-1 LAN-STATIC: 192.168.1.254 Pfsense-1 GUEST-STATIC: 192.168.10.254

PFSENSE-2 Pfsense-2 WAN-DHCP: 192.168.50.2 Pfsense-2 LAN-STATIC: 192.168.1.222 Pfsense-2 GUEST-STATIC: 192.168.10.222

CARP ASSIGNMENTS pfSense WAN-VIP: 192.168.50.3 pfSense LAN-VIP: 192.168.1.201 pfSense GUEST-VIP: 192.168.10.201

Now, I am double nating, but this works fine too. Each pfSense has an ip address on the 192.168.50.0/24 network for their WAN ports which are on my EdgeRouter-X segment.

Failover for pfSense-1 to pfSense-2 happens pretty quick. Failback of course has some timeouts since the network interfaces come up and begin working before the system is fully up.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.