HAProxy主备（Active-Passive）模式LAN中断时VIP功能是否正常的咨询

Great question—let’s break this down clearly, since this is a super common gotcha with active-passive HAProxy setups (usually paired with tools like Keepalived for VIP management).

First, a quick recap for context: In a standard active-passive setup, you’ve got a VIP (Virtual IP) managed by a protocol like VRRP (via tools such as Keepalived) or CARP. This VIP "floats" between your two HAProxy nodes—only one node holds the VIP at any time, and all external traffic routes to whichever node has it.

When the LAN link between the two nodes drops, the behavior depends on two key things: whether the active node is still healthy, and how your failover tool is configured.

1. If the Active Node is Still Up & Running #

• The active node will keep holding the VIP and keep handling traffic like nothing’s wrong. It has no way to know the passive node exists anymore (since the LAN is down), but it doesn’t need to—it’s still operational.
• The problem? The passive node will think the active node has failed (because it can’t reach it over the LAN). So the passive node will claim the VIP for itself using VRRP/CARP.
• End result: You’re stuck in a split-brain scenario—both nodes are now holding the same VIP. External traffic might flip-flop between nodes based on your network’s ARP cache, leading to:
  • Inconsistent client experiences (connecting to two separate HAProxy instances)
  • Potential data conflicts or service disruptions if your backend services aren’t built to handle this

2. If the Active Node Has Failed (Alongside the LAN Break) #

• If the active node goes down and the LAN link breaks, the passive node will detect the active node is unreachable (via its health checks) and take over the VIP as intended. This works because the passive node correctly assumes the active node is dead.
• The only catch here is that if the LAN break is the only issue (active node is totally fine), you’ll end up with the split-brain problem I mentioned above.

How to Avoid Split-Brain #

To prevent this scenario entirely, here are a few proven fixes:

• Use a dedicated heartbeat network: Set up a separate, isolated LAN link just for node-to-node communication. That way, if the main LAN goes down, the heartbeat link still works to confirm each node’s health.
• Add a witness node: Bring in a third, lightweight "witness" node that both HAProxy nodes can reach. The witness acts as a tiebreaker to confirm which node is actually active, stopping split-brain before it starts.
• Tweak ARP settings: Configure Keepalived to send gratuitous ARP packets more frequently when taking over the VIP. This flushes network caches faster, ensuring traffic routes to the correct node.

内容的提问来源于stack exchange，提问作者Swarup Saha