Connection tracking sync#
The third tab of High availability, at /ha?tab=conntrack.
A VRRP failover moves the virtual addresses. It does not move the router's table of open connections, so the partner that takes over does not know the connections that were going through the other router, and drops their packets. Connection tracking sync closes that gap: the two routers exchange connection state over a link between them, and the one that takes over already knows every connection.
It needs a VRRP sync group in place first: the sync group is what tells it which router is active.
The tab#
When it is on, the tab shows the links it syncs over (with the partner's address when it syncs by unicast), the sync group it follows, the protocols it syncs, the multicast group and the listen address. Edit opens the editor.
When it is off, the tab says so and offers Set up connection sync.
The editor#
| Field | Notes |
|---|---|
| Follows sync group | The VRRP sync group whose failover moves the connections |
| Sync links | One or more interfaces the routers exchange state over — ideally a link that carries nothing else — each with the partner's address for unicast, or empty for multicast |
| Protocols | TCP, UDP, ICMP, ICMPv6, SCTP and DCCP. With none chosen, every protocol is synced. A new setup starts with TCP, UDP and ICMP |
| Multicast group | The group multicast sync uses; empty is the router's default |
| Listen address | The address to accept sync from; empty is any |
Turn off asks once more, then removes connection tracking sync entirely.
Both routers need it, following their own copy of the same sync group, over the same link.
See also#
- VRRP — the groups and sync groups this follows.
- Build a VRRP pair — both routers, step by step.