opnsense / opnsense/plugins

net/frr: carp demote does not chnage the metric of a default route

Open
#5,496 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

support
Dominant language
PHP
Stars
1.2k
Forks
863
Avg merge
2d 6h
Merged PRs (30d)
10

Description

Describe the bug

When two OPNsense instances share an VIP via CARP on the WAN interface and are part of an OSPF area on LAN, the backup instance does not demote its default route.
This means the other routers in the OSPF area randomly select either OPNsense instance for the default route.
This leads to problems with the Firewall, where a TCP connection was allowed by one instance, but not already synced to the other and the other then drops the packets. This behavior leads to a noticeable delay, since a few percent of the connections are dropped.

To Reproduce

  1. Configure two OPNsense instances with CARP on WAN
  2. Install net/frr
  3. Routing -> General -> enable [x]
  4. Routing -> OSPF -> General -> enable [x]
  5. Routing -> OSPF -> General -> Advertise Default Gateway[x]
  6. Routing -> OSPF -> Interfaces -> +
    7. Interace = LAN
    8. Area = 0.0.0.0
    9. Cost = 10
    10. Cost (when demoted) = 2000
    11. Depend on (carp) = WAN
    12. Network Type = "Point-to-point network"

Expected behavior

To have one default route metric set to 2000.

Environment
Software version used and hardware type if relevant.
e.g.:

Type opnsense-business
Version 26.4_20
Architecture amd64
Commit 5a5d24ec7

Hardware: two DEC2770 and a Cisco Layer 3 Switch

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the two-instance CARP and OSPF setup described in the issue, focusing on the net/frr plugin's handling of CARP demotion and the OSPF default-gateway advertisement. Confirm that the backup instance advertises its default route with metric 2000 while demoted, and verify that the other routers consistently select the active instance.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.