[BACK]Return to ifstated.conf CVS log [TXT][DIR] Up to [local] / src / etc
File: [local] / src / etc / Attic / ifstated.conf (download)

Revision 1.6, Mon Feb 7 06:08:10 2005 UTC (19 years, 3 months ago) by david
Branch: MAIN
CVS Tags: OPENBSD_5_5_BASE, OPENBSD_5_5, OPENBSD_5_4_BASE, OPENBSD_5_4, OPENBSD_5_3_BASE, OPENBSD_5_3, OPENBSD_5_2_BASE, OPENBSD_5_2, OPENBSD_5_1_BASE, OPENBSD_5_1, OPENBSD_5_0_BASE, OPENBSD_5_0, OPENBSD_4_9_BASE, OPENBSD_4_9, OPENBSD_4_8_BASE, OPENBSD_4_8, OPENBSD_4_7_BASE, OPENBSD_4_7, OPENBSD_4_6_BASE, OPENBSD_4_6, OPENBSD_4_5_BASE, OPENBSD_4_5, OPENBSD_4_4_BASE, OPENBSD_4_4, OPENBSD_4_3_BASE, OPENBSD_4_3, OPENBSD_4_2_BASE, OPENBSD_4_2, OPENBSD_4_1_BASE, OPENBSD_4_1, OPENBSD_4_0_BASE, OPENBSD_4_0, OPENBSD_3_9_BASE, OPENBSD_3_9, OPENBSD_3_8_BASE, OPENBSD_3_8, OPENBSD_3_7_BASE, OPENBSD_3_7
Changes since 1.5: +6 -6 lines 

indentation whitespace nits

# $OpenBSD: ifstated.conf,v 1.6 2005/02/07 06:08:10 david Exp $
# This is a sample config for a pair of firewalls with two interfaces
#
# carp0 and carp1 have ip addresses on 192.168.3.0/24 and 192.168.6.0/24
# respectively.

# net.inet.carp.preempt must be enabled (set to 1) for this to work correctly.

# Uncomment one of the following lines to force primary/backup status.
# init-state primary
# init-state backup

carp_up = "carp0.link.up && carp1.link.up"
carp_down = "!carp0.link.up && !carp1.link.up"
carp_sync = "carp0.link.up && carp1.link.up || \
    !carp0.link.up && !carp1.link.up"

# The "net" addresses are other addresses which can be used to determine
# whether we have connectivity. Make sure the hosts are always up, or
# test multiple ip's, 'or'-ing the tests.
net = '( "ping -q -c 1 -w 1 192.168.6.8 > /dev/null" every 10 && \
    "ping -q -c 1 -w 1 192.168.3.8 > /dev/null" every 10)'

# The peer addresses below are the real ip addresses of the OTHER firewall
peer = '( "ping -q -c 1 -w 1 192.168.6.7 > /dev/null" every 10 && \
    "ping -q -c 1 -w 1 192.168.3.7 > /dev/null" every 10)'

state auto {
	if $carp_up
		set-state primary
	if $carp_down
		set-state backup
}

state primary {
	init {
		run "ifconfig carp0 advskew 10"
		run "ifconfig carp1 advskew 10"
	}
	if ! $net
		set-state demoted
}

state demoted {
	init {
		run "ifconfig carp0 advskew 254"
		run "ifconfig carp1 advskew 254"
	}
	if $net
		set-state primary
}

state promoted {
	init {
		run "ifconfig carp0 advskew 0"
		run "ifconfig carp1 advskew 0"
	}
	if $peer || ! $net
		set-state backup
}

state backup {
	init {
		run "ifconfig carp0 advskew 100"
		run "ifconfig carp1 advskew 100"
	}
	# The "sleep 5" below is a hack to dampen the $carp_sync when we come
	# out of promoted state. Thinking about the correct fix...
	if ! $carp_sync && $net && "sleep 5" every 10
		if ! $carp_sync && $net
			set-state promoted
}