Hello,
I'm having two routers, interconnected via ether5 <--> ether5 via:
R1's IP 10.10.20.1/32
R2's IP 10.10.20.2/32
These routers then connect to switches and whatnot, the idea is that I'd have multiple VLANs that terminate on these routers and would love to have VRRP interfaces for each VLAN. Therefore, I'd create the VLAN interfaces on both, the VRRP interface on both (with different priorities), assign IPs and then I saw that it VRRP master/backup state misbehaves. I read the docs and saw that If multiple VRRP interfaces are configured between two units and sync-connection-tracking=yes is required, it must be enabled only on one of the VRRP interfaces, preferably the one designated as the group-authority.. So I created two group-authorities and it seems fine, but I don't know how I can see if the states are really in sync. Configs below:
R1:
/ip/address/export
# 2026-04-29 07:42:54 by RouterOS 7.21.4
# system id = 9l7zFtxe8mG
#
/ip address
add address=10.255.255.2 interface=lo network=10.255.255.2
add address=10.10.10.2 interface=ether1 network=10.10.10.1
add address=10.10.20.1 interface=ether5 network=10.10.20.2
add address=172.23.0.1 interface=B3-F0-GW network=172.23.0.0
add address=172.23.0.2/24 interface=Building3-Floor0 network=172.23.0.0
add address=172.25.0.2/24 interface=Building5-Floor0 network=172.25.0.0
add address=172.25.0.1 interface=B5-F0-GW network=172.25.0.1
add address=172.25.14.1 interface=B5-F14-GW network=172.25.14.1
add address=172.25.14.2/24 interface=Building5-Floor14 network=172.25.14.0
add address=172.23.1.2/24 interface=Building3-Floor1 network=172.23.1.0
add address=172.23.1.1 interface=B3-F1-GW network=172.23.1.1
/interface/vlan/export
# 2026-04-29 07:44:33 by RouterOS 7.21.4
# system id = 9l7zFtxe8mG
#
/interface vlan
add interface=ether8 name=Building3-Floor0 vlan-id=300
add interface=ether8 name=Building3-Floor1 vlan-id=301
add interface=ether8 name=Building5-Floor0 vlan-id=500
add interface=ether8 name=Building5-Floor14 vlan-id=514
/interface/vrrp/export
# 2026-04-29 07:43:22 by RouterOS 7.21.4
# system id = 9l7zFtxe8mG
#
/interface vrrp
add group-authority=self interface=Building3-Floor0 name=B3-F0-GW remote-address=10.10.20.2 \
sync-connection-tracking=yes
add group-authority=B3-F0-GW interface=Building3-Floor1 name=B3-F1-GW
add group-authority=self interface=Building5-Floor0 name=B5-F0-GW priority=50
add group-authority=B5-F0-GW interface=Building5-Floor14 name=B5-F14-GW priority=50
R2 config:
/ip/address/export
# 2026-04-29 07:43:40 by RouterOS 7.21.4
# system id = K5XLIlqumJJ
#
/ip address
add address=10.255.255.3 interface=lo network=10.255.255.3
add address=10.10.10.4 interface=ether2 network=10.10.10.3
add address=10.10.20.2 interface=ether5 network=10.10.20.1
add address=172.23.0.3/24 interface=Building3-Floor0 network=172.23.0.0
add address=172.23.0.1 interface=B3-F0-GW network=172.23.0.0
add address=172.25.0.3/24 interface=Building5-Floor0 network=172.25.0.0
add address=172.25.0.1 interface=B5-F0-GW network=172.25.0.1
add address=172.25.14.1 interface=B5-F14-GW network=172.25.14.1
add address=172.25.14.3/24 interface=Building5-Floor14 network=172.25.14.0
add address=172.23.1.3/24 interface=Building3-Floor1 network=172.23.1.0
add address=172.23.1.1 interface=B3-F1-GW network=172.23.1.1
/interface/vlan/export
# 2026-04-29 07:43:57 by RouterOS 7.21.4
# system id = K5XLIlqumJJ
#
/interface vlan
add interface=ether8 name=Building3-Floor0 vlan-id=300
add interface=ether8 name=Building3-Floor1 vlan-id=301
add interface=ether8 name=Building5-Floor0 vlan-id=500
add interface=ether8 name=Building5-Floor14 vlan-id=514
/interface/vrrp/export
# 2026-04-29 07:43:52 by RouterOS 7.21.4
# system id = K5XLIlqumJJ
#
/interface vrrp
add group-authority=self interface=Building3-Floor0 name=B3-F0-GW priority=50 remote-address=10.10.20.1 \
sync-connection-tracking=yes
add group-authority=B3-F0-GW interface=Building3-Floor1 name=B3-F1-GW
add group-authority=self interface=Building5-Floor0 name=B5-F0-GW
add group-authority=B5-F0-GW interface=Building5-Floor14 name=B5-F14-GW
Basically R1 and R2 should own the VRRP interface for different buildings (R1 should be the VRRP masterfor Building3 and backup for Building5, and R2 should be the VRRP master for Building5, backup for Building3).
So, is this the correct way to use group-authority? Am I missing something?
Also, it seems that I can only set the remote-address and sync-connection-tracking on one of the VRRP interface, the other ones seem to ignore the option, I guess that's a global thing?!