Checklist and troubleshooting
Checklist
- Two routers, VRRP on every segment they share, in one sync group.
- Upstream routes to your LAN point at the WAN virtual address, not a router's own.
- DHCP gives out the virtual address as the gateway; split pools (or Kea high availability) on the two servers; static mappings on both.
- DNS forwarders listen on the virtual address, and DHCP hands out only that.
- Test the failover by actually failing a router, and watch DNS as well as ping.
- Decide whether the primary should preempt when it returns.
When it doesn't work
| Symptom | Look at | Usual cause |
|---|---|---|
| Both routers MASTER | show vrrp on both | They can't hear each other's advertisements: VLAN, firewall, or different VRIDs |
| Failover works one way only | The ISP's route to your LAN | Pointing at one router's WAN address instead of the virtual one |
| Hosts get no address | DHCP client output, show dhcp server leases | No range, wrong subnet, or a relay/VLAN problem |
| Two hosts with the same address | Lease tables on both routers | Overlapping pools on two servers |
| Network "down" for users after a failover, ping fine | DNS lookups and timings | DNS servers are the routers' own addresses |
vyos@R2:~$ show configuration commands | match "high-availability|dhcp-server|dns forwarding|interfaces ethernet eth. (address|desc)|protocols static"
set high-availability vrrp group LAN address 10.0.0.1/24
set high-availability vrrp group LAN interface 'eth0'
set high-availability vrrp group LAN priority '100'
set high-availability vrrp group LAN vrid '10'
set high-availability vrrp group WAN address 203.0.113.4/29
set high-availability vrrp group WAN interface 'eth1'
set high-availability vrrp group WAN priority '100'
set high-availability vrrp group WAN vrid '20'
set high-availability vrrp sync-group MAIN member 'LAN'
set high-availability vrrp sync-group MAIN member 'WAN'
set interfaces ethernet eth0 address '10.0.0.3/24'
set interfaces ethernet eth0 description 'LAN'
set interfaces ethernet eth1 address '203.0.113.3/29'
set interfaces ethernet eth1 description 'WAN'
set protocols static route 0.0.0.0/0 next-hop 203.0.113.1
set service dhcp-server shared-network-name LAN subnet 10.0.0.0/24 lease '86400'
set service dhcp-server shared-network-name LAN subnet 10.0.0.0/24 option default-router '10.0.0.1'
set service dhcp-server shared-network-name LAN subnet 10.0.0.0/24 option domain-name 'office.example'
set service dhcp-server shared-network-name LAN subnet 10.0.0.0/24 option name-server '10.0.0.1'
set service dhcp-server shared-network-name LAN subnet 10.0.0.0/24 range 0 start '10.0.0.150'
set service dhcp-server shared-network-name LAN subnet 10.0.0.0/24 range 0 stop '10.0.0.199'
set service dhcp-server shared-network-name LAN subnet 10.0.0.0/24 static-mapping PRINTER ip-address '10.0.0.20'
set service dhcp-server shared-network-name LAN subnet 10.0.0.0/24 static-mapping PRINTER mac '02:00:00:00:00:02'
set service dhcp-server shared-network-name LAN subnet 10.0.0.0/24 subnet-id '1'
set service dns forwarding allow-from '10.0.0.0/24'
set service dns forwarding listen-address '10.0.0.3'
set service dns forwarding listen-address '10.0.0.1'
set service dns forwarding name-server 192.0.2.53- Line 1: Everything from this lesson on R2, as committed.