setup ha

[itmwiw]

Hello,
First of all, thanks for the effort and keep up the good work!
I have some questions regarding the limitations of opnsense API.
I would like to write an ansible playbook that set up an Opnsense HA cluster and I would like to confirm whether I get it right or not.
From my understanding, it is possible to:

• configure carp virtual ip on both firewalls,
• add firewall rules as wanted

However, there are some limitations inherited from the opnsense api, including:

• It is not possible to configure an interface: like set a static ip adress or disable dhcp,
• Configure pfsync between the two firewalls.
  Is that correct or did I miss something?

[ansibleguy]

Greetings.
Yes - that seems to be the current state of the API implementation.

You can easily check the implementation using the Browser 'Developer Console'.
Log-in to your firewall, perform the action you would like to automate and check how the requests are performed.
In API-enabled parts the request will:

• be sent to an URL starting with the '/api' location (most of the time)
• use data in json format as request payloads
• return data in json format as responses

In case of the interface management one can see that OPNSense V23.1.8 uses:

• Interface settings
  • URL: interfaces.php?if=lan
  • Request: in form-format (many URL parameters)
  • Response: im HTML format
• Interface assignment
  • URL: interfaces_assign.php
  • Request/Response: dito

It would be technically possible to automate it by replicating that older implementation - but not that 'clean'.

- AnsibleGuy