CARP in FreeBSD (HSRP/VRRP alternative)

CARP can be used for several things, but I’m going to concentrate on a HSRP/VRRP alternative in this post (having a hot standby on a seperate computer).

To enable CARP support, you need to add the following line in your kernel config file (in /usr/src/sys/<arch>/conf/):

device carp

Once you have built and installed your new kernel, you can configure a CARP interface.  To use carp, you need a non-carp IP on your interface on each computer and then a second shared IP.  For this purpose we will use as the shared IP and as the fixed non-carp IP on the fxp0 interface.

Edit your /etc/rc.conf file as follows:

ifconfig_fxp0=”inet netmask″

ifconfig_carp0=”vhid 1 advskew 100 pass p4ssw0rd″

To explain the carp0 line in more detail…

The vhid contains the virtual interface ID.  There seems to be some confusion online whether this should be identical or different on machines.  Personally, I use the same vhid on primary and backup hosts.

The advskew value specifies which should be primary and backup.  A lower figure is a higher priority so the master should be a lower number than the secondary.

The pass value is the authentication value.  This needs to match between primary and backup machines.  The password is sent plaintext over the interface, so is easily snooped unfortunately.

Finally, the shared IP is listed.  This needs to match an existing subnet on the machine or the carp interface will not be configured.

An example of a backup to the above machine (using as its non-carp IP) would have the following config:

ifconfig_fxp0=”inet netmask″

ifconfig_carp0=”vhid 1 advskew 200 pass p4ssw0rd″

As you can see, it is identical except fxp0 has a different IP, and the advskew is higher making the priority lower.

To check on the status, you run ifconfig carp0 – it should look similar to the following:

carp0: flags=49<UP,LOOPBACK,RUNNING> metric 0 mtu 1500
inet netmask 0xffffff00
carp: MASTER vhid 1 advbase 1 advskew 100

That should be all you need to configure carp on a FreeBSD machine.

Leave a Reply

Your email address will not be published. Required fields are marked *