Re: Upgrading a CARP firewall cluster

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Tuesday, April 30, 2019 9:29 PM, Lyndon Nerenberg <lyndon@orthanc.ca> wrote:

> On our systems, we run the 'a' machine as primary and the 'b' machine
> as backup. When upgrading, we do the 'b' machine first, since this
> doesn't disrupt the primary. After the 'b' machine is fully configured,
> monitor its state table to ensure it's consistent with the 'a'
> machine. Once you are convinced pf is staying in sync, demote the
> 'a' machine and upgrade it.

Thanks for your procedure tips, that's pretty much the same procedure I use except that I didn't even demote the "a" machine before upgrading it. Now I guess demoting the machine in question before upgrading it is the best practice and so I checked the OpenBSD FAQ about CARP and see different methods. The "carpdemote" way seems the cleanest way so as I have 8 carp interfaces all in the default carp group, should I simply run the following command:

$ ifconfig -g carp carpdemote 50

or what is your way of demoting the server before upgading it?

Regards,
Mabi