Two or more OPNsense firewalls can be configured as redundant firewalls with automatic fail-over. If one of the network interfaces fails on the primary firewall or the primary firewall goes offline entirely, the secondary becomes active.
Viewing Sensei Status on HA
For an OPNsense cluster environment, the Sensei plugin should be installed on all cluster nodes separately.
By navigating to Sensei → Configuration → HA on OPNsense GUI, you can view the Sensei versions on the backup firewalls.
Figure 1: Status on a HA OPNsense Cluster Firewall
“Sensei versions on the Backup FW” pane provides detailed information about:
Application Database version
Rules Database version
Reporting Database version
If Sensei is running on a standalone firewall, not a cluster firewall, the “Backup FW IP not defined” message is displayed in this HA tab.
Figure 2: HA page on a standalone firewall.
If you have an OPNsense cluster firewall, you can view the details of the Sensei versions and Sensei services status on the Backup firewall. You can also check whether the configuration and policies are synchronized with the secondary firewall or not.
Figure 3: HA page on a cluster firewall.
If you change Sensei configuration and policies on the primary OPNsense, a warning message indicating that you are working on a cluster system and system configuration should be synchronized appears on the screen. You can initiate a synchronization by clicking the “Sync” button in the notification message.
In “Backup FW Sensei Services Status” pane, you can view the status of the following Backup Firewall services:
Sensei Engine and
Sensei Reporting Database.
In “Backup FW Sensei Services” pane, you can view
the synchronization status of the Sensei Configuration
the synchronization status of the Sensei Policies
last Update Time of the Sensei Configuration
last Update Time of the Sensei Policies
Black Cloud with an up arrow icon in the Status means that Sensei Configuration/Policies is/are not synchronized with backup firewall. To synchronize them, click this button in the status column.
Checkmark icon means that in the Status means that Sensei Configuration/Policies is/are not synchronized with backup firewall.
Figure 4: Synchronization of Sensei Configuration and Policies with Backup Firewall
Figure 5: Sensei Configuration and Policies are synchronized with Backup Firewall