I'm setting up a High Availability Cluster with two pfSense SG-4860 routers. I have a question about setting up the network. Here is the diagram they provide:

enter image description here

I have a question about the WAN part. One of their prerequisites is:

  • A High Availability cluster needs three IP addresses in each subnet along with a separate unused subnet for the Sync interface. For WANs, this means that a /29 subnet or larger is required for an optimal configuration.

My question is: does this mean I need three external IP addresses from my ISP, or is it possible to do these internally with one external IP address from the ISP? Which would provide the best solution? I guess I'm just confused when it comes to this part of the network. Any feedback would be appreciated.


I found this link on Super User: Can an ISP provide two static IPs over a single cable? Is this generally the way a network handles more than one IP address from an ISP?

2 Answers 2


The requirement is that each router have its own IP address (that's two), and there needs to be a virtual IP address (that makes three). If you are doing this on the public side, you will need three public addresses from your ISP, and that will require a maximum mask length of /29 since /30 will only give you two usable addresses.

I'm not sure what you mean by, "routing these to the switch," since switches don't know anything about IP addresses or routing.

  • The part where i'm having a problem understanding is how to use more than one IP address from an ISP. Is this something that i need to setup equipment for? or does the ISP provide this and i just plug in a switch and have access to the IP address? i guess the "WAN mask /29" confuses me. I don't know if i need to set this up, or not. Commented Mar 30, 2016 at 15:08
  • You must request such a network from your ISP ($$$). After you get it, you assign each router one of the addresses in the network, and you configure the cluster to have another for its virtual address.
    – Ron Maupin
    Commented Mar 30, 2016 at 15:11
  • is this generally expensive? Commented Mar 30, 2016 at 15:42
  • It gets more expensive every day since the RIRs ran out of IPv4 addresses to assign to the ISPs. The ISPs are resorting to CGN for residential users in order to preserve their precious hoards of public IPv4 addresses for the business users who will pay for them. What it costs depends on your ISP.
    – Ron Maupin
    Commented Mar 30, 2016 at 15:46
  • I see, what goes into doing this on our own network instead of the ISP? Commented Mar 30, 2016 at 16:27


What I did was, I simply setup my pfSense, behind my first router/firewall. So, ISP <----> Modem <----> EdgeRouter-X (WAN PORT-DHCP to ISP) <---> Pfsense Server in Cluster (DHCP Reserved lease to EdgeRouter).

Edge Firewall (EdgeRouter-X) WAN: DHCP to ISP LAN: DHCP Server: -

PFSENSE-1 Pfsense-1 WAN-DHCP: Pfsense-1 LAN-STATIC: Pfsense-1 GUEST-STATIC:

PFSENSE-2 Pfsense-2 WAN-DHCP: Pfsense-2 LAN-STATIC: Pfsense-2 GUEST-STATIC:


Now, I am double nating, but this works fine too. Each pfSense has an ip address on the network for their WAN ports which are on my EdgeRouter-X segment.

Failover for pfSense-1 to pfSense-2 happens pretty quick. Failback of course has some timeouts since the network interfaces come up and begin working before the system is fully up.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.