Repository navigation
HA Sync not working in pfSense 2.9.0 #954
Description
Describe the bug
When HA Sync is enabled in the REST api it does not sync the changes to the secondary node. pfSense built-in HA sync does work with same user / password. The pfsync user has been assigned WebCfg - All pages Allow access to all pages (admin privilege) priviliges. The pfsync user was even made member of the group admins to rule out a privilege issue. I've enabled / disabled HA Sync various times, made vanity changes but none of the changes / settings were synced to the other node. Enabled / disabled the HA Sync Validate Certs although a valid LE cert for the host and GUI is active and this should just work. There is only one node the settings need to be synced to and it's IP is listed and correct. The same version of pfSense-RESTAPI-pkg has been installed on both nodes.
To Reproduce
Create a HA setup and make sure changes are replicated to standby. Install pfSense-RESTAPI-pkg on both nodes. Configure ``pfSense-RESTAPIand enableHA Sync`. Make changes on the primary node, check standby node and you will see they are not synced from primary.
Expected behavior
RESTAPI changes get correctly synced to standby node listed in the configuration.
pfSense Version & Package Version:
- pfSense Version: pfSense 2.9.0 (all patches applied to current date)
- Package Version v2.9.0
Affected Endpoints:
- URL: system_restapi_settings.php
Activity
jaredhendrickson13 commentedon Oct 19, 2026
Are there any logs in Status > System Logs > Packages > REST API after this occurs?
hydro-b commentedon Oct 21, 2026
Oct 21 19:46:39 redacted restapi[76801]: Failed to sync REST API settings to 10.0.0.2: REST API settings sync is not enabled on this host.On the primary node
HA Sync,HA Sync Hosts,HA Username, andHA Sync Passwordare set. On the secondary node this is not configured. Is that a problem?Note: the sync user is present on the secondary node (and the same password configured).
jaredhendrickson13 commentedon Oct 21, 2026
REST API v2.9.0 introduced some breaking changes to the settings sync in response to GHSA-8q8g-9f77-8g8g. One of them was the requirement for the remote peer to have the HA Sync toggle enabled before accepting sync requests. Enabling just the HA Sync toggle in the REST API settings on the remote peer should allow it to start accepting the sync requests again. HA Sync Hosts, HA Username and HA Sync Password aren't needed on remote peers. If you still have trouble getting it to work afterward let me know.
The help text for that toggle in the UI doesn't explain this well. I'll be sure to update the help text in the documentation to make this behavior more obvious going forward.
Thanks!
docs(RESTAPISettings): describe the need to enable hasync on remote p…
hydro-b commentedon Oct 22, 2026
Ah, I see. I didn't know that / didn't read it on a place where it would have given me a hint, i.e. a note in the
HA Syncdescription (in bold) that tells you to tick the box on the standby node also. You have acknowledged that so in the future hopefully no more reports like mine ;-).Thanks!