Upgrading High Availability Clusters¶

This page provides guidance on upgrading redundant firewalls (CARP, pfsync, XMLRPC config sync) across major versions of pfSense® software. Upgrading from one version to another generally follows the this procedure, exceptions are noted later in the page.

Review changelog/blog/upgrade guide
Take a backup from both nodes. Do not skip this step!
Upgrade secondary as described in the Upgrade Guide
Test secondary to be sure it is operating OK – expected packages present, services running, no obvious errors in logs, etc
Switch CARP to maintenance mode on primary from Status > CARP
Ensure traffic is still flowing properly and that the network is functional. If it is not, then exit maintenance mode on the primary, fix the secondary then try again.
Upgrade primary as described in the Upgrade Guide
Check primary to ensure it upgraded OK – expected packages present, services running, no obvious errors in logs, etc
Exit maintenance mode on primary
Test again

XMLRPC Config Sync Considerations¶

Upgrade either the primary or the secondary first, leaving the other on the older version until testing is complete.

Supported versions of pfSense software from the last several years properly check for and prevent unintentionally synchronizing data between incompatible versions.

pfsync considerations¶

The underlying pfsync protocol often changes between FreeBSD versions. Versions of pfSense software with a different base OS version of FreeBSD cannot sync their states between each other. Failover will still function, but not stateful failover so all existing connections will be dropped.

pfsync and State Policy¶

The State Policy (Firewall State Policy) of the firewall can introduce a conflict in state synchronization if nodes using pfsync do not have identical hardware.

See pfsync and Physical Interfaces for details and a potential workaround.

CARP considerations¶

CARP is generally the same between versions and will fail over and back as expected.