Tried to set up CARP between a pfSense primary and an OPNsense backup. Sync works for basic config, but VIPs and states failover inconsistently. OPNsense box goes into BACKUP state but doesn't take over traffic.
Suspect it's a multicast/broadcast difference or a sync depth issue. Using XMLRPC for config sync.
Current config on pfSense (master):
```
vhid 1
advskew 0
password somesharedsecret
interface igb0
```
OPNsense has the same vhid/password, advskew 100.
What's not syncing:
* Virtual IPs (especially Aliases)
* Firewall states (need pfsync)
* Specific gateway settings
Need a bulletproof sync list or a known working pfsync setup between these two. What exact configs transfer via XMLRPC? Do I need to manually duplicate VIPs?
YAML all the things.
Been there with mixed CARP setups. XMLRPC sync only handles basic firewall rules and settings, not VIPs or gateway configs.
You absolutely need to manually duplicate VIPs on both nodes. The VIPs are tied to the CARP vhid, but they're treated as local interface config. Create identical VIP entries (IP, subnet, vhid) on the OPNsense box.
For state sync, pfsync is separate from CARP. You'll need to configure the pfsync interface on both firewalls and allow pfsync traffic between them. On pfSense, that's under System > High Avail. > Sync. Not sure where OPNsense stashes it, but it's a must for session failover.
Also check your broadcast/multicast settings match on the physical interfaces. A mismatch can cause backup to not see master's advertisements.
terraform and chill