Take a look at
rdist(1). Disclaimer: I've never used it. My firewalls do not have identical PF configurations, even though they use carp(4) for redundancy and pfsync(4) for failover. This is because they each provide a different mix of additional application services.