Re: Pfsync + CARP

["Bill Marquette" <billm@ucsecurity.com>]

FWIW, I've been running a version of ifstated from an early Feb snapshot
on some lab equipment w/out any issues.  I fully agree pfsync + carp rox,
pfsync + carp + ifstated covers nearly every failure scenario in a setup
where both firewalls are plugged into physically different equipment.  For
the record, I have had a NIC fail on an active firewall, however the
kernel panic that occured nanoseconds later effectively meant the machine
wasn't going to be sending VRRP (ahem, or CARP) anyway...IOW, protecting
against NIC failures are a pointless reason to run ifstated.  Protection
against link failure due to cable issues (cuts, pulls, spontaneous
combustion, etc) or switch failures (if your failover machine is on a
DIFFERENT switch) is a good reason for ifstated.

--Bill