High Availability pfSense in vSphere Part 2

In part 1, we set up the high-availbility pfSense pair. Now we need to configure OSPF so that all VLANs created within pfSense will get advertised out to our router. Doing this means we will not need to create static routes for the VLANs created within pfSense.

First thing is to create another VLAN in pfSense. I already have VLAN 100 for pfsync, so I created a new VLAN 110 for a network.

pfSense has several packages available for OSPF, and I decided to use FRR.

In the pfSense web interface, go to System \ Package Manager.

Then to Available Packages.

Find and install frr.

After installation, we need to configure the OSPF settings.
First we will go to Services \ FRR Global/Zebra

We need to Enable FRR, Master Password is required, select a CARP Status IP, and provide a router ID.
Router ID does not actually need to be the IP address; it is just a 32-bit number.
To keep things descriptive, I just use the primary device IP (or in this case, the WAN CARP IP.)

Now go to OSPF interfaces, as we need to create the pfSense interface that will be used for OSPF route distribution.

Click Add.

We are advertising via the WAN interface, and then a description.
As this is just my homelab, I’m not concerned with authentication.

Next we will need to go to the OSPF configuration area. Click the [OSPF] link.
Enable OSPF router, provide router ID and set the default area.
Default area, again, is not an IP address just written like one.
I left default area type at normal, as none of the other types really fit.

Only other setting here I configured was to enable Redistribute Connected Networks in the Route Redistribution, as we want this to redistribute routing to networks only available behind this.

Now that pfSense has OSPF enabled and configured, we need to configure OSPF on our EdgeRouter.
In this instance, we need to configure OSPF on the eth1 (LAN) interface, as that is the interface our pfSense WAN is connected to.

Enable OSPF on eth1, set priority 0 (as it’s primary for the network,) set to broadcast, configure router-id, and configure area.

ubnt@edgerouter# set interfaces ethernet eth1 ip ospf priority 0
ubnt@edgerouter# set interfaces ethernet eth1 ip ospf network broadcast
ubnt@edgerouter# set protocols ospf parameters router-id
ubnt@edgerouter# set protocols ospf area 0 network
ubnt@edgerouter# commit;save
Saving configuration to '/config/config.boot'...

We should be broadcasting now, and as both devices are configured let’s see if our EdgeRouter can see pfSense as an OSPF neighbor.

ubnt@edgerouter:~$ show ip ospf neighbor

Total number of full neighbors: 0
OSPF process 0 VRF(default):
Neighbor ID     Pri   State            Dead Time   Address         Interface           Instance ID     1   Init/DROther     00:00:33   eth1                    0

Wonderful! The EdgeRouter sees device with router ID (our pfSense) as an OSPF neighbor.
Now to make sure pfSense can see the EdgeRouter with router ID as an OSPF neighbor.

Back in the pfSense web interface, go to the Status menu in FRR.

Select OSPF to view just the OSPF status.

Scroll down to OSPF neighbors.

We can see that pfSense is detecting router ID as an OSPF neighbor.

Now let’s look at the OSPF database in OSPF. In the OSPF status page, scroll down to OSPF Database.
We can see that it is advertising the and networks via

On our EdgeRouter, we can validate that the routes for those subnets are being received via OSPF.

ubnt@edgerouter:~$ show ip route ospf
IP Route Table for VRF "default"
O E2 *> [110/20] via, eth1, 00:21:28
O E2 *> [110/20] via, eth1, 00:21:28

We can also show all the routes and source of the routes on the EdgeRouter.

ubnt@edgerouter:~$ show ip route forward dev eth1.10 proto kernel scope link src dev eth1.20 proto kernel scope link src dev eth1.30 proto kernel scope link src dev eth1.40 proto kernel scope link src via dev eth1 proto zebra via dev eth1 proto zebra dev eth1 proto kernel scope link src dev eth1.60 proto kernel scope link src

I removed the eth0 (WAN) routers, but we can see that the first 4 routes are configured via VLANs on the EdgeRouter, but the next two are via OSPF (via Zebra package.)
From a workstation on the network, we can see that there is connectivity.


Tracing route to over a maximum of 30 hops

0 boxen.incendiary.local []

Leave a Reply

Your email address will not be published. Required fields are marked *