We’ve regularly used VRRP in our setups for automatic failover and it works great. Recently we had an install where we have a CCR1009-7G-1C-1S+ (MTik01) and an RB1100AHx2 (MTik02) (I know, not ideal to re-use the older hardware, but an issue called for using what we had onhand). Using the same configurations as usual, these 2 MikroTiks are able to communicate but each sets itself as the Master on VRRP and takes the assigned VRRP IP Address. I’ve tried a few different tweaks but have had no luck so far. Is this possibly an issue between the hardware models and this won’t work? I’ve included a snippet of the configuration below.
Which RouterOS version are you using? RouterOS v7 supports grouping of VRRP interfaces, where all group members are either VRRP MASTER or BACKUP. In your case, VRRP group will prevent the situation where vrrp_wifi is master but vrrp_lan is backup on the same device.
Post your firewall config on both routers. If both go into RM it means they cannot see Vrrp traffic between each other.
Do you approve Vrrp in firewall to input?
Below is all that is really on them, there’s a few DSTNAT/SRCNATs for public IPs and DHCP networks. This config is the same as on other MikroTiks/sites and has no issues with VRRP. The only thing different here is MTik01 is a CCR1009 and MTik02 is a RB1100AHx2. I did add an input for VRRP which would increment, but both Routers continued to set as RM.
How are they actually connected together, bridges or external switches? You can’t just have MTik01 ether1 connected to MTik02 ether1, and similiarly MTik01 ether2 connected to MTik02 ether2, as nothing else whould be connected.
There’s a switch in between. VLAN 100 is LAN Management and VLAN 101 is WIFI Management. VLANs are correct between the firewalls. Confirmed that they can see each other through neighbors and can ping local IP of each other. And for example, if I disable VRRP on MTik02, it can ping and see MTik01 with the correct .1 IP Address.
Check your switches / vlan configurations. VRRP sends a broadcast, if the master transits the packet and the slave does not receive said packet, the slave becomes master. That’s really the only way how a slave can promote itself to master.
Either there’s no communication between the routers on the interfaces that you’ve configured vrrp on, or the configurations don’t match. the one router is not seeing the other router, and visa versa.
Does the routers see each other on layer 2? Does it have ARP entries for example for the neiboring routers?
Yes. I’ve confirmed both Routers can see each on Layer 2 and show up in each others Neighbors. VLANs are correct on the switches. I agree, it seems like the Routers aren’t communicating on VRRP, but from the absolute best I can tell, nothing is wrong with the configuration. As I’ve mentioned earlier, the MikroTiks have the exact configuration as other MikroTiks at different locations where VRRP is working without issue. Same for the switch configs. The only difference here is that we have a CCR1009 with an RB1100AHx2. I’ve been curious all along if this is some hardware issue between the 2 that isn’t playing nice.
The model shouldn’t make any difference unless there is something broken in the version of RouterOS you are using on those architectures.
You could use the packet sniffer to see if each is receiving the VRRP packets from the other, and that the contents are correct (the are small enough to decode by hand, or stream the packet sniffer output to Wireshark, or similar)
Using the Packet Tracer tool from both MikroTiks I can see that neither is receiving VRRP packets; both only show sending which seems odd because the VRRP input in filter did increment when added, although slowly. Confirms what we’ve discussed, but I’m still unsure where the disconnect is. I’ve reviewed the switch config as well and I don’t see anything that looks to be out of sorts there either; but I’ll continue digging around in both the MikroTiks and switch.
Thanks for all the responses. Ended up finding the issue further down in the switch yesterday. IGMP Snooping had been enabled for this site and it by default had applied to all configured VLANs. Once I got that straightened out, VRRP started responding normally between the 2 MikroTiks.
