VRRP issue - both routers in Master State

RouterOS General
1

I have 2 RB450G’s using RouterOS 4.14, and I am trying to setup a VRRP interface on both routers. I’ve followed the Wiki instructions to do the following:

VIP: 192.168.1.1/32
R1: 192.168.1.254/24
R2: 192.168.253/24

R1 setup:

/interface vrrp add interface=ether1-gateway vrid=49 priority=254
/ip address add address=192.168.1.1/32 interface=vrrp1

R2 setup:

/interface vrrp add interface=ether1-gateway vrid=49
/ip address add address=192.168.1.1/32 interface=vrrp1

Normally R1 will be the Master, and R2 should be the Backup, however both R1 and R2 are stuck as Master (which is causing a lot a trouble).

R1:

/interface vrrp print
 0   RM name="vrrp1" mtu=1500 mac-address=00:00:5E:00:01:31 arp=enabled interface=ether1-gateway vrid=49 
        priority=254 interval=1 preemption-mode=yes authentication=none password="" on-backup="" 
        on-master=""

R2:

/interface vrrp print
 0   RM name="vrrp1" mtu=1500 mac-address=00:00:5E:00:01:31 arp=enabled interface=ether1-gateway vrid=49 
        priority=100 interval=1 preemption-mode=yes authentication=none password="" on-backup="" 
        on-master=""

I’ve tried doing a /system reset-configuration on both routers. I used to be on RouterOS 4.13, and I tried upgrading to 4.14 to see if that made a difference. Is there something I’m doing wrong, or is this a bug with RouterOS?

2

If both routers are stuck on Master state, it means that either routers can’t communicate with each other using these addresses
R1: 192.168.1.254/24
R2: 192.168.253/24
or VRRP multicast traffic is dropped on routers itself or somewhere in the network between both routers. Check your firewall and enable vrrp debug logs to verify if multicast packets are received.

3

Thanks for the reply. I enabled logging in the firewall for dropped packets, and it turns out that the firewall on each MikroTik router was dropping the VRRP packets.

If I don’t use encryption on VRRP, i have to add an input rule to accept protocol 112 (VRRP). If I use AH encryption, i have to accept protocol 51 (IPSec-ah) instead of 112.