Carp Suppression

[Yar Tikhiy]

On Wed, Jun 15, 2005 at 02:32:19PM -0400, Josh Kayse wrote:
> On 6/15/05, Gleb Smirnoff <glebius at freebsd.org> wrote:
> <snip> 
> > AFAIU, you use PLIP line as some flag that triggers suppression. If
> > slave "sees" master via PLIP, it keeps itself in slave mode. May be
> > I don't understand you right.
> > 
> > Although the idea is not officially supported, it is interesting. Can you
> > please draw your setup, since I don't understand it clearly?
> > 
>             __________
> em0      |                |em1
> ------------|     FW1    |-----------
>             |_________|
>    xl0(carp0)|     | plip0(carp1)
>             ___|___|___
> em0     |                 | em1
> -----------|     FW2     |----------
>            |__________|
> 
> 
> Bridging is done through em0/em1 which are both monitored by ifstated
> for link state only (backported patch from HEAD).
> 
> When one of the bridging ports is disconnected, ifstaded changes the
> advskew of carp0 and carp1 to 254 so that the carp interfaces
> failover.
> 
> When ifstated see the carp interfaces as BOTH master, the slave
> firewall takes over bridging.
> 
> This gives us redundant firewalls, with redundant heartbeat connections.

In fact, not all network failures lead to detectable link loss.  I
can imagine a situation when the switch port FW1-em0 is connected
to just hangs and so FW1 is unable to notice the event.  If CARP
ran on the em0 side of FW1 and FW2, they would notice such an event
though due to CARP packets unable to flow between FW1-em0 and FW2-em0
any longer.  The advantage of CARP used customarily and not on a
separate "heartbeat" interface is that it provides active detection
of failures on the very network that should be made fail-safe.

-- 
Yar