{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/pfsense-ha-upgrade-mixed-version-state-continuity/", "item": { "id": "https://update.dsesecurity.com/updates/pfsense-ha-upgrade-mixed-version-state-continuity/", "slug": "pfsense-ha-upgrade-mixed-version-state-continuity", "url": "https://update.dsesecurity.com/updates/pfsense-ha-upgrade-mixed-version-state-continuity/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/pfsense-ha-upgrade-mixed-version-state-continuity.md", "json": "https://update.dsesecurity.com/api/v1/posts/pfsense-ha-upgrade-mixed-version-state-continuity/" }, "title": "Allow for lost sessions while pfSense HA nodes run incompatible state-sync versions", "summary": "An HA upgrade can preserve failover capability while still interrupting established connections.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-15T13:33:35+00:00", "modified_at": "2026-10-15T13:36:17+00:00", "reviewed_on": "2026-10-15", "reading_minutes": 2, "word_count": 260, "potentially_affected": "This applies to redundant pfSense firewalls during major-version upgrades. The current release notes and upgrade guide take precedence over a generic sequence, especially for DHCP or hardware-specific changes.", "dse_recommendation": "DSE recommends writing the upgrade window around both service availability and session interruption.", "primary_source": { "name": "Netgate — Upgrading HA clusters", "url": "https://docs.netgate.com/pfsense/en/latest/install/upgrade-guide-ha.html", "published_on": null, "authority": "docs.netgate.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

An HA upgrade can preserve failover capability while still interrupting established connections.

\n

Source facts

\n

Netgate’s HA upgrade guide distinguishes failover from stateful failover. The pfsync protocol can change with the underlying FreeBSD version, leaving mixed-version nodes unable to synchronize states. In that situation, failover can still occur, but existing connections are dropped. The documented general sequence backs up both nodes, upgrades and checks the secondary, shifts service using persistent CARP maintenance mode on the primary, then upgrades the primary and tests again. Release-specific instructions and state-policy compatibility must also be reviewed.

\n

Source: Netgate — Upgrading HA clusters.

\n

Applicability

\n

This applies to redundant pfSense firewalls during major-version upgrades. The current release notes and upgrade guide take precedence over a generic sequence, especially for DHCP or hardware-specific changes.

\n

DSE recommendation

\n

DSE recommends writing the upgrade window around both service availability and session interruption. Identify applications that cannot tolerate a reconnect and notify their owners before the role transition. Preserve separate backups for both nodes and verify the alternate node’s packages, services, and logs before moving traffic. Define the conditions for returning service to the original node if validation fails. Do not promise uninterrupted sessions merely because CARP still changes roles or because both nodes show healthy interfaces.

\n

Verification

\n

In a representative test or approved maintenance window, track a long-lived test connection across each role change and verify new connections separately. Record software versions and observed state synchronization. Recheck application behavior after the nodes return to the same supported version and intended primary role.

\n

Official reference

\n

Netgate — Upgrading HA clusters. Reviewed October 15, 2026.

", "content_text": "An HA upgrade can preserve failover capability while still interrupting established connections.\nSource facts\nNetgate’s HA upgrade guide distinguishes failover from stateful failover. The pfsync protocol can change with the underlying FreeBSD version, leaving mixed-version nodes unable to synchronize states. In that situation, failover can still occur, but existing connections are dropped. The documented general sequence backs up both nodes, upgrades and checks the secondary, shifts service using persistent CARP maintenance mode on the primary, then upgrades the primary and tests again. Release-specific instructions and state-policy compatibility must also be reviewed.\nSource: Netgate — Upgrading HA clusters.\nApplicability\nThis applies to redundant pfSense firewalls during major-version upgrades. The current release notes and upgrade guide take precedence over a generic sequence, especially for DHCP or hardware-specific changes.\nDSE recommendation\nDSE recommends writing the upgrade window around both service availability and session interruption. Identify applications that cannot tolerate a reconnect and notify their owners before the role transition. Preserve separate backups for both nodes and verify the alternate node’s packages, services, and logs before moving traffic. Define the conditions for returning service to the original node if validation fails. Do not promise uninterrupted sessions merely because CARP still changes roles or because both nodes show healthy interfaces.\nVerification\nIn a representative test or approved maintenance window, track a long-lived test connection across each role change and verify new connections separately. Record software versions and observed state synchronization. Recheck application behavior after the nodes return to the same supported version and intended primary role.\nOfficial reference\nNetgate — Upgrading HA clusters. Reviewed October 15, 2026.", "content_markdown": "An HA upgrade can preserve failover capability while still interrupting established connections.\n\n## Source facts\n\nNetgate’s HA upgrade guide distinguishes failover from stateful failover. The pfsync protocol can change with the underlying FreeBSD version, leaving mixed-version nodes unable to synchronize states. In that situation, failover can still occur, but existing connections are dropped. The documented general sequence backs up both nodes, upgrades and checks the secondary, shifts service using persistent CARP maintenance mode on the primary, then upgrades the primary and tests again. Release-specific instructions and state-policy compatibility must also be reviewed.\n\nSource: [Netgate — Upgrading HA clusters](https://docs.netgate.com/pfsense/en/latest/install/upgrade-guide-ha.html).\n\n## Applicability\n\nThis applies to redundant pfSense firewalls during major-version upgrades. The current release notes and upgrade guide take precedence over a generic sequence, especially for DHCP or hardware-specific changes.\n\n## DSE recommendation\n\nDSE recommends writing the upgrade window around both service availability and session interruption. Identify applications that cannot tolerate a reconnect and notify their owners before the role transition. Preserve separate backups for both nodes and verify the alternate node’s packages, services, and logs before moving traffic. Define the conditions for returning service to the original node if validation fails. Do not promise uninterrupted sessions merely because CARP still changes roles or because both nodes show healthy interfaces.\n\n## Verification\n\nIn a representative test or approved maintenance window, track a long-lived test connection across each role change and verify new connections separately. Record software versions and observed state synchronization. Recheck application behavior after the nodes return to the same supported version and intended primary role.\n\n## Official reference\n\n[Netgate — Upgrading HA clusters](https://docs.netgate.com/pfsense/en/latest/install/upgrade-guide-ha.html). Reviewed October 15, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/pfsense-ha-upgrade-mixed-version-state-continuity/", "url": "https://update.dsesecurity.com/updates/pfsense-ha-upgrade-mixed-version-state-continuity/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-15" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/pfsense-ha-upgrade-mixed-version-state-continuity/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Allow for lost sessions while pfSense HA nodes run incompatible state-sync versions", "item": "https://update.dsesecurity.com/updates/pfsense-ha-upgrade-mixed-version-state-continuity/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/pfsense-ha-upgrade-mixed-version-state-continuity/#article", "identifier": "https://update.dsesecurity.com/updates/pfsense-ha-upgrade-mixed-version-state-continuity/", "url": "https://update.dsesecurity.com/updates/pfsense-ha-upgrade-mixed-version-state-continuity/", "headline": "Allow for lost sessions while pfSense HA nodes run incompatible state-sync versions", "description": "An HA upgrade can preserve failover capability while still interrupting established connections.", "abstract": "An HA upgrade can preserve failover capability while still interrupting established connections.", "articleBody": "An HA upgrade can preserve failover capability while still interrupting established connections.\nSource facts\nNetgate’s HA upgrade guide distinguishes failover from stateful failover. The pfsync protocol can change with the underlying FreeBSD version, leaving mixed-version nodes unable to synchronize states. In that situation, failover can still occur, but existing connections are dropped. The documented general sequence backs up both nodes, upgrades and checks the secondary, shifts service using persistent CARP maintenance mode on the primary, then upgrades the primary and tests again. Release-specific instructions and state-policy compatibility must also be reviewed.\nSource: Netgate — Upgrading HA clusters.\nApplicability\nThis applies to redundant pfSense firewalls during major-version upgrades. The current release notes and upgrade guide take precedence over a generic sequence, especially for DHCP or hardware-specific changes.\nDSE recommendation\nDSE recommends writing the upgrade window around both service availability and session interruption. Identify applications that cannot tolerate a reconnect and notify their owners before the role transition. Preserve separate backups for both nodes and verify the alternate node’s packages, services, and logs before moving traffic. Define the conditions for returning service to the original node if validation fails. Do not promise uninterrupted sessions merely because CARP still changes roles or because both nodes show healthy interfaces.\nVerification\nIn a representative test or approved maintenance window, track a long-lived test connection across each role change and verify new connections separately. Record software versions and observed state synchronization. Recheck application behavior after the nodes return to the same supported version and intended primary role.\nOfficial reference\nNetgate — Upgrading HA clusters. Reviewed October 15, 2026.", "datePublished": "2026-10-15T13:33:35+00:00", "dateModified": "2026-10-15T13:36:17+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/pfsense-ha-upgrade-mixed-version-state-continuity/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/pfsense-ha-upgrade-mixed-version-state-continuity/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Allow for lost sessions while pfSense HA nodes run incompatible state-sync versions" }, "articleSection": [ "Business Continuity", "Networks & Infrastructure" ], "keywords": [ "Business Continuity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 260, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Netgate — Upgrading HA clusters", "url": "https://docs.netgate.com/pfsense/en/latest/install/upgrade-guide-ha.html" } } ] } }