VRRP#
The second tab of High availability, at /ha?tab=vrrp. Two routers share a
virtual address; the one with the higher priority answers for it, and the other takes over
when the first stops advertising. This tab creates, edits and deletes the groups, and
shows which router holds each one now.
The tiles#
| Tile | Shows |
|---|---|
| VRRP groups | How many there are, and how many this router holds |
| VRRP service | Running or Stopped. Stopped is normal with no groups: the service starts with the first one |
| Sync groups | Groups that fail over together |
| Connection sync | Whether open connections survive a failover — see Connection tracking sync |
The groups table#
| Column | What it shows |
|---|---|
| Group | The group's name, with its description |
| Interface | The interface the virtual addresses are on |
| VRID | The virtual router ID, the same on both routers |
| Virtual addresses | The addresses the group moves |
| Priority | 100 unless set |
| State | Master (this router holds the addresses), Backup, Fault or Starting, as the router reports it; Disabled, Not reported or Not running when there is no state to show |
| Since | How long it has been in that state |
Adding or editing a group#
Add VRRP group, or click a group.
| Field | Notes |
|---|---|
| Group name | Letters, digits, hyphens and underscores. Fixed once the group exists |
| Interface | Any interface, VLANs included |
| VRID | 1 to 255, the same on both routers. A new group gets the first free one on its interface, and a VRID another group on the interface has is refused |
| Priority | 1 to 255. The router with the higher priority holds the addresses |
| Virtual addresses | Each with the prefix length of the network it is on, such as 192.0.2.254/24; IPv6 too |
| Preemption | On by default: a higher-priority router takes the addresses back when it returns. Preemption delay waits that many seconds first |
| Advertisement interval | Seconds between advertisements, 1 by default |
| RFC 3768 virtual MAC address | Switches see one MAC address for the group through a failover |
| Group disabled | Keeps the group configured and stops it |
| Authentication | None, Password or IPsec AH. The password is up to 8 characters and the same on both routers |
| Unicast peers | The partner's address, where multicast advertisements cannot be used; empty advertises by multicast |
| Source address | The address advertisements are sent from |
| Description |
The partner router needs the same group: the same VRID and virtual addresses, and a different priority. Build the partner's with the same form.
Delete group asks once more, then deletes the group and removes it from any sync group; a sync group left with no member goes too. A group that connection tracking sync depends on — the only member of the sync group it follows — cannot be deleted until connection sync is turned off.
Sync groups#
A sync group makes several groups fail over together, such as a router's LAN and WAN sides: when one moves to the partner, all of them do. Add sync group takes a name and its members; click one to change its members or delete it. The sync group connection tracking sync follows cannot be deleted while that is on.
See also#
- Connection tracking sync — keeping connections alive across a failover.
- Build a VRRP pair — both routers, step by step.
- Uplinks (multi-WAN) — more than one way out, on one router.