enable support for deferring the packet that creates a state so that your

sync peers are able to get the states before the replies. previously there
was a race where the reply could hit a partner firewall before it had the
state for it, which caused the reply to get processed by the ruleset which
probably would drop it.

this behaviour is off by default because it does delay packets, which is
only wanted in active-active firewalls or when an upstream router is slow
to learn that you're moved the active member of the pfsync cluster. it also
uses memory keeping the packets in the kernel.

use "ifconfig pfsync0 defer" to enable it, "ifconfig pfsync0 -defer" to
disable.

tested by sthen@ who loves it. he's got manpage changes coming up for me.

0 files changed, 0 insertions, 0 deletions