Ok, I can understand if it's not working with more than 2 firewalls. But it's not working with 2 ! The details I sent are only for 2 firewalls ATM. Le ven. 27 nov. 2020, à 13 h 57, Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> a écrit : > > On Fri, Nov 27, 2020 at 11:56:22AM -0500, Jean-Sébastien Frerot wrote: > > Hi, I'm trying to set up conntrackd in FTFW mode with the multicast protocol. > > The problem I'm having is that my BACKUP firewall is not getting the > > states as it's supposed to. > > It's receiving the packets (confirmed by a tcpdump), but only a few > > states are replicated, even when I used the '-B' option to resend all > > the states to the slaves. > > > > If I configure it to use unicast UPD, all is working fine. > > I was hoping to use multicast so I can migrate my current active > > firewalls, to a new pair of firewalls. But for this to work, I need to > > sync the states to all my 4 firewalls. > > FT-FW only works with 2 firewalls. For more than 2 firewalls, please > try NOTRACK mode. > > FT-FW would need to be extended to support more than 2 firewalls, by > adding some sort of node ID and independent retransmissions queues for > each firewall in the cluster. -- Jean-Sébastien Frerot Senior Linux System Administrator jsfrerot@xxxxxxxxx 410 St.Nicolas, suite 400 Montréal, QC H2Y 2P5 www.ludia.com
