Protocol CARP - Revision history

Yousra: /* ESXI and CARP */

2026-03-29T15:00:53Z

ESXI and CARP

2026-03-22T20:24:31Z

← Older revision		Revision as of 20:24, 22 March 2026
Line 390:		Line 390:
	https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/8-0/vsphere-security/securing-vsphere-networking/securing-vsphere-standard-switches.html		https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/8-0/vsphere-security/securing-vsphere-networking/securing-vsphere-standard-switches.html


			== ESXI and CARP ==

	Linked to {{T\|2227}}		Linked to {{T\|2227}}

2026-03-18T08:16:16Z

Peer

← Older revision		Revision as of 08:16, 18 March 2026
Line 265:		Line 265:
	In addition to that, using CARP in unicast mode can be appropriate in a two-router topology, as communication only needs to occur between 2 specific peers.		In addition to that, using CARP in unicast mode can be appropriate in a two-router topology, as communication only needs to occur between 2 specific peers.

	~~Also~~ IPsec (security added in a classic tunnel) protects unicast traffic, it does not protect (or protects very poorly) multicast traffic. So if we want CARP to be used with IPsec, peer is an excellent choice.		Above all IPsec (security added in a classic tunnel) protects unicast traffic, it does not protect (or protects very poorly) multicast traffic. So if we want CARP to be used with IPsec, peer is an excellent choice.

	Router-002 :		Router-002 :

2026-03-18T08:14:38Z

Peer

← Older revision		Revision as of 08:14, 18 March 2026
Line 264:		Line 264:

	In addition to that, using CARP in unicast mode can be appropriate in a two-router topology, as communication only needs to occur between 2 specific peers.		In addition to that, using CARP in unicast mode can be appropriate in a two-router topology, as communication only needs to occur between 2 specific peers.

			Also IPsec (security added in a classic tunnel) protects unicast traffic, it does not protect (or protects very poorly) multicast traffic. So if we want CARP to be used with IPsec, peer is an excellent choice.

	Router-002 :		Router-002 :

2026-03-17T08:26:47Z

Master Election Process

← Older revision		Revision as of 08:26, 17 March 2026
Line 187:		Line 187:
	All hosts begin in BACKUP state.		All hosts begin in BACKUP state.

	2. Each host starts a timer		2. Each host starts a timer, a counter

	* The delay depends on the CARP priority.		* The delay depends on the CARP priority.

2026-03-16T21:39:21Z

Peer

← Older revision		Revision as of 21:39, 16 March 2026
Line 282:		Line 282:

	https://docs.opnsense.org/manual/how-tos/carp.html		https://docs.opnsense.org/manual/how-tos/carp.html

			https://www.kernel-panic.it/openbsd/carp/carp4.html

	== Basic configuration ==		== Basic configuration ==

2026-03-16T21:35:40Z

Peer

← Older revision		Revision as of 21:35, 16 March 2026
Line 272:		Line 272:

	'''ifconfig_vmx1_alias0="inet vhid 2 advskew 0 pass seediez7ae7LooFevohshae4oot0EeR peer 178.32.70.110 alias 51.68.252.230/32"'''		'''ifconfig_vmx1_alias0="inet vhid 2 advskew 0 pass seediez7ae7LooFevohshae4oot0EeR peer 178.32.70.110 alias 51.68.252.230/32"'''


			We see that the Master router-003 sends advertissements to router-002.nasqueron.org/178.32.70.110
			[[ File:Peer.png ]]

	Sources :		Sources :

2026-03-16T21:28:14Z

Preemption

← Older revision		Revision as of 21:28, 16 March 2026
Line 258:		Line 258:

	https://vincentdelft.be/post/post_20241115		https://vincentdelft.be/post/post_20241115

			== Peer ==

			By default, CARP uses multicast to send advertisements. However, multicast traffic can be filtered, restricted and so unreliable. Configuring CARP to use unicast advertisements between peers can help ensure more stable and predictable high-availability operation.

			In addition to that, using CARP in unicast mode can be appropriate in a two-router topology, as communication only needs to occur between 2 specific peers.

			Router-002 :

			'''ifconfig_vmx1_alias0="inet vhid 2 advskew 100 pass seediez7ae7LooFevohshae4oot0EeR peer 178.32.70.111 alias 51.68.252.230/32"'''

			Router-003 :

			'''ifconfig_vmx1_alias0="inet vhid 2 advskew 0 pass seediez7ae7LooFevohshae4oot0EeR peer 178.32.70.110 alias 51.68.252.230/32"'''

			Sources :

			https://man.freebsd.org/cgi/man.cgi?query=carp

			https://docs.opnsense.org/manual/how-tos/carp.html

	== Basic configuration ==		== Basic configuration ==

2026-03-16T13:41:59Z

Preemption

← Older revision		Revision as of 13:41, 16 March 2026
Line 256:		Line 256:

	https://man.freebsd.org/cgi/man.cgi?carp(4)		https://man.freebsd.org/cgi/man.cgi?carp(4)

			https://vincentdelft.be/post/post_20241115

	== Basic configuration ==		== Basic configuration ==

2026-03-16T13:35:27Z

Preemption

← Older revision		Revision as of 13:35, 16 March 2026
Line 243:		Line 243:
	== Preemption ==		== Preemption ==

	In fact, after some research, I discovered that on FreeBSD, the preemption behavior of CARP (Common Address Redundancy Protocol) is controlled by the kernel parameter net.inet.carp.preempt. This parameter allows a router with a higher priority (a lower advskew) to become MASTER, even if another router is already active in that role. To check if preemption is enabled, you can use the command :		In fact, after some research, I discovered that on FreeBSD, the preemption behavior of CARP (Common Address Redundancy Protocol) is controlled by the kernel parameter net.inet.carp.preempt. This parameter allows a router with a higher priority (a lower advskew) to become MASTER, even if another router is already active in that role or if the real Master was restart after. To check if preemption is enabled, you can use the command :

	'''sysctl net.inet.carp.preempt'''		'''sysctl net.inet.carp.preempt'''