What is VRRP?

VRRP (Virtual Router Redundancy Protocol) lets two or more routers share one virtual gateway address on a LAN, so hosts keep working if one router fails.

Hosts are usually configured with a single default gateway, so if that router dies the whole LAN loses its way out, even with a second router sitting next to it. VRRP solves this with a virtual address that belongs to the group rather than to either router. The current version, VRRPv3 in RFC 5798, covers both IPv4 and IPv6. The routers in a group share a virtual router ID (VRID) and each has a priority from 1 to 254, 100 by default; the highest becomes master, holds the virtual address and answers for it, while the others are backups. The master multicasts advertisements, once a second by default, as IP protocol 112 to 224.0.0.18 (ff02::12 for IPv6). If the backups miss about three in a row, the one with the highest priority takes over and sends gratuitous ARP, or for IPv6 Neighbor Advertisements, so switches and hosts update their tables. The protocol defines a virtual MAC address of 00-00-5E-00-01-<VRID> for this, though some implementations use the router's own MAC instead.

In practice, set the hosts' gateway to the VRRP address (DHCP should hand that out, never a router's own address) and decide whether the original master should take the role back when it recovers. Preemption is on by default, which costs a brief handover, and can be turned off or delayed. If both routers claim to be master, they can't hear each other's advertisements, typically because of a VLAN mismatch, a firewall or different VRIDs. Cisco's HSRP does the same job in a proprietary way. See also LAN. The Office gateway: DHCP, DNS and VRRP on VyOS lesson runs a real failover and the outage it exposed.