Guides · High availability
pfSense high availability: CARP, state sync and Netgate pairs
When the firewall itself must not be a single point of failure, the answer is a redundant pair: two identical Netgate appliances, one active and one on standby, sharing virtual IP addresses. pfSense Plus coordinates them with CARP and keeps firewall states synchronized.
When you need high availability
Multi-WAN protects against a line failure; high availability protects against a firewall failure. They solve different problems and are often combined:
- Services that must stay reachable even during firewall maintenance or a hardware fault.
- Environments where a reboot window for updates is not acceptable.
- Continuity requirements — the same resilience NIS2 expects from network measures.
How the pair works
- CARP: the two nodes share virtual IPs; if the master fails, the backup takes over the addresses.
- Configuration synchronization: rules, interfaces and services replicate from the master to the backup over a dedicated sync interface.
- State synchronization (pfsync): existing firewall states are replicated, so most connections survive the failover.
- Identical hardware: the pair must consist of two appliances of the same model.
What HA does not cover
A redundant pair does not replace Multi-WAN: if the single Internet line goes down, both nodes are offline. It does not protect against a switch failure in front of the firewalls, and a power cut in one rack still needs separate power feeds — the dual hot-swap PSU of the 8300 MAX protects a node, not the rack.
Hardware choices
The pair doubles the hardware and must be designed well:
- Common pairs: 4200 for distributed sites, 6100 and 8200 for 10 GbE edges, 8300 for data-centre deployments.
- Two identical appliances, a dedicated synchronization link and the switch ports to match.
- For maximum resilience: 8300 MAX with dual hot-swap power supplies, rack, and separate power feeds.
Plan the architecture with us
A redundant pair only delivers value if designed well: sync interfaces, addressing, switch layout and failover tests. Send us the scenario and we prepare the design and the pre-configuration.
Frequently asked questions
Is Multi-WAN enough, or do I need HA?
They answer different failures: Multi-WAN covers the line, HA covers the firewall. An office with a single line and an acceptable maintenance window often stays with one appliance; services that cannot stop usually need both.
Do the two nodes have to be identical?
Yes: the pair must consist of two appliances of the same model, with a dedicated synchronization interface between them.
Do connections survive a failover?
Most do: pfsync replicates firewall states to the backup, which takes over the virtual IPs. Some edge cases — connections mid-handshake — may need to be re-established.
Does HA cover power failures?
Partially: the 8300 MAX has dual hot-swap power supplies, which protects a single node. A whole-rack or site outage needs independent power feeds or a second site.