Two routers, one virtual address#

You will end up with two routers sharing a virtual address on a network, one of them holding it at a time, and clients using that address as their gateway rather than either router's own.

Before you start#

The operator role and a licence on both routers.
Two routers on the same network, each with its own address on that interface.
A virtual address on that network that nothing else uses.

Step 1 — Create the group on the first router#

Network → High availability → VRRP → Add VRRP group.

Group name: what the group is for, such as LAN.
Interface: the interface on that network; a VLAN works like any other.
VRID: the page suggests the first free one on the interface. Note it.
Priority: higher than the partner's — say 200 for the primary.
Virtual addresses: the shared address with its prefix length, such as 192.0.2.1/24.

Step 2 — Create the matching group on the second router#

The same form on the second router: the same VRID and virtual addresses, and a lower priority, such as 100.

Preemption decides what happens when the primary comes back after a failure: on, it takes the addresses back; off, the partner keeps them until it fails in turn. Preemption delay lets the returning router settle first.

Step 3 — Authentication and unicast, if you need them#

Authentication → Password stops anything else on the network from advertising a higher priority by mistake. The password is up to 8 characters, the same on both routers, and sent in the clear: it prevents a mistake, not an attacker. The page never shows it again once saved.

Unicast peers takes the partner's address, for a network where multicast is filtered or unreliable.

Step 4 — Sync groups, for several networks#

If a router should hold the LAN address and the WAN address together — never one without the other — create a group for each, then Add sync group with both as members, on both routers.

Step 5 — Apply on both routers, one at a time#

Apply on the intended primary first, confirm it holds the address, then on the partner.

Connection state across a failover#

Without it, every open connection breaks when the addresses move. High availability → Connection sync → Set up connection sync, on both routers: choose the sync group it follows, the interface the routers exchange state over — one that carries nothing else — and the partner's address on it for unicast.

Check it worked#

Both routers agree on who holds the addresses. The VRRP tab shows Master on one router and Backup on the other, with how long each has been so.

Two masters is the failure to look for. It means the routers cannot see each other's advertisements: a firewall rule, a switch, or a VRID that does not match.

Then fail it on purpose. On the master, open the group and switch Group disabled on. The partner should take the addresses within a few advertisement intervals, and a client pinging the virtual address should lose a packet or two at most. Switch it back off and watch the addresses return, or stay put without preemption.

What you still have to do twice#

Everything else: firewall rules, NAT, DHCP, DNS records, port forwards, accounts, API tokens, backups. Two routers in a VRRP pair are two routers. Config as code keeps them in step, with a reconcile loop or a scripted apply — a convention you maintain, not a feature of VRRP.

Undoing it#

Turn connection sync off, then delete the group — on the backup first, then the master, so the address never has two claimants and never has none. Deleting a router's last group removes its VRRP configuration entirely.