Hey folks,

I have just committed CARP to NetBSD that you can see here:

http://mail-index.netbsd.org/source-changes/2006/05/18/0004.html

What is CARP?
------------

CARP is the Common Address Redundancy Protocol which orignated from
the OpenBSD Project and is incorparated in FreeBSD and now NetBSD!

Quoted from http://www.openbsd.org/faq/pf/carp.html -

" CARP is the Common Address Redundancy Protocol. Its primary purpose
is to allow multiple hosts on the same network segment to share an IP  
address.
CARP is a secure, free alternative to the Virtual Router Redundancy  
Protocol
and the Hot Standby Router Protocol.

CARP works by allowing a group of hosts on the same network segment to
share an IP address. This group of hosts is referred to as a  
"redundancy group".
The redundancy group is assigned an IP address that is shared amongst  
the
group members. Within the group, one host is designated the "master" and
the rest as "backups". The master host is the one that currently  
"holds" the
shared IP; it responds to any traffic or ARP requests directed  
towards it.
Each host may belong to more than one redundancy group at a time.

One common use for CARP is to create a group of redundant firewalls.
The virtual IP that is assigned to the redundancy group is configured on
client machines as the default gateway. In the event that the master  
firewall
suffers a failure or is taken offline, the IP will move to one of the  
backup
firewalls and service will continue unaffected.

CARP supports IPv4 and IPv6."

How do I enable CARP ?
-----------------

You can now use CARP (assuming you're tracking the last developments)
by adding the following line to your kernel configuration file:

pseudo-device		carp

Then proceed to build/re-build your kernel. Make sure you also build
ifconfig and netstat (and install of course). Once you have built your
kernel and installed it you're now ready for use.

Example configuration
-------------------

As mentioned earlier, CARP is great for usage on firewalls. I will show
a popular and basic example here. Assume the following (lightly assume):

			  Internet/Outside world
					|
					|
				---------
				|  firewall  |
				---------
					|
					|
	----------- Shared LAN -------------

The obvious problem with this is that here the firewall is a single
point of failure. When it goes down for reasons such as:

	- Botched upgrade
	- The other 100 reasons here

its normally tough luck. Unless you fix it, you have no internet
(in the majority of cases).

However, with CARP we can now have something like this:

		    ---Internet/Outside world---
		  |						   |
	          |						   |
		em1						em1
	    ---------                           ----------
             |  firewall1 |				|  firewall 2  |
	    ---------                          -----------
		em0					       em0
		  |						 |
		  |						 |
	----------- Shared LAN -------------

When data comes from the Shared LAN destined for the outside world
the two machines talk to each other and decided who's the MASTER
and thus will handle the data. So for example, with the below  
configuration
firewall 1 is the MASTER firewall and firewall 2 is the BACKUP  
firewall. If
firewall 1 goes down, all traffic is automatically handled by  
firewall 2 completely
transparent to the user. Infact, you could put an axe through  
firewall 1 and
nothing would change. If firewall 1 then managed to recover, it could  
then
resume its position.

Configuration for the above
-----------------------

Interface IP Addresses:

firewall 1 em0: 172.16.0.1
firewall 1 em1: 192.0.2.1
firewall 2 em0: 172.16.0.2
firewall 2 em1: 192.0.2.2

The IPs we wish to share:

LAN shared IP: 172.16.0.100
WAN/Internet shared IP: 192.0.2.100

On firewall 1:

! enable preemption and group interface failover (man carp)
# sysctl -w net.inet.carp.preempt=1

! configure CARP on the LAN side
# ifconfig carp1 create
# ifconfig carp1 vhid 1 carpdev em0 pass lanpasswd \
      172.16.0.100 255.255.255.0

! configure CARP on the WAN/Internet side
# ifconfig carp2 create
# ifconfig carp2 vhid 2 carpdev em1 pass netpasswd \
     192.0.2.100 255.255.255.0

On firewall 2:

! enable preemption and group interface failover (man carp)
# sysctl -w net.inet.carp.preempt=1

! configure CARP on the LAN side
# ifconfig carp1 create
# ifconfig carp1 vhid 1 carpdev em0 pass lanpasswd \
      advskew 128 172.16.0.100 255.255.255.0

! configure CARP on the WAN/Internet side
# ifconfig carp2 create
# ifconfig carp2 vhid 2 carpdev em1 pass netpasswd \
     advskew 128 192.0.2.100 255.255.255.0

For more complete information regarding each configuration setting
see carp(4).

Other
-----

I would 'really' like further testing with CARP on NetBSD. I  
currently can't
test very many network configurations due to my small home network.
If you find any issues, please contact me and let me know - its likely
to be my error. Thanks to everyone who has helped me test too!

References
---------

http://www.countersiege.com/doc/pfsync-carp/
http://www.openbsd.org/faq/pf/carp.html

		---
		Liam J. Foy
		<liamjfoy@netbsd.org>
		<liamfoy@sepulcrum.org>
		BSDPortal.org