On Fri, Nov 27, 2020 at 11:56:22AM -0500, Jean-Sébastien Frerot wrote: > Hi, I'm trying to set up conntrackd in FTFW mode with the multicast protocol. > The problem I'm having is that my BACKUP firewall is not getting the > states as it's supposed to. > It's receiving the packets (confirmed by a tcpdump), but only a few > states are replicated, even when I used the '-B' option to resend all > the states to the slaves. > > If I configure it to use unicast UPD, all is working fine. > I was hoping to use multicast so I can migrate my current active > firewalls, to a new pair of firewalls. But for this to work, I need to > sync the states to all my 4 firewalls. FT-FW only works with 2 firewalls. For more than 2 firewalls, please try NOTRACK mode. FT-FW would need to be extended to support more than 2 firewalls, by adding some sort of node ID and independent retransmissions queues for each firewall in the cluster.
