From mboxrd@z Thu Jan 1 00:00:00 1970 From: Pablo Neira Ayuso Subject: Re: Linux Firewall Active/Active Date: Thu, 6 Nov 2014 00:55:38 +0100 Message-ID: <20141105235538.GA3599@salvia> References: Mime-Version: 1.0 Return-path: Content-Disposition: inline In-Reply-To: Sender: netfilter-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Paul Robert Marino Cc: shawn wilson , Arturo Borrero Gonzalez , Ricardo Klein , netfilter On Wed, Nov 05, 2014 at 05:43:39PM -0500, Paul Robert Marino wrote: > I've actually been doing this successfully with conntrakd, keepalived, > and quagga > > Essentially I'm using quaga for OSPF and BGP externally with equal cost paths. > > For conntrackd with FTFW and "DisableExternalCache On" > > Do NOT use the howto's on the web or the examples that come with > conntrakd or keepalived for configuring keepalived they are outdated > and can cause major problems. It would be great if you can contribute a patch to extend the conntrack-tools manual to document this. The documentation is available in docbook format in the git tree. People asks for this configuration on the mailing list from time to time. Thanks. P.S: I think that update should also indicate that possible race conditions may happen between the synchronization and packets in active/active asymmetric path, so people are aware of it too.