Hello,
I am playing around with 7.1beta2 and noticed with VRRP there is an option to enable sync-connection-tracking.
I have not been able to find any documentation on how to configure it. I have it enabled and have the remote IP set to the other router but nothing ever seems to be synced when i look under the firewall connections.
Is there any documentation for this feature or is it still incomplete?
Re: VRRP sync-connection-tracking setup
If VRRP is up and running, then in most cases, simply setting on both ends should do the trick: VRRP master syncing its connection with the backup router.
Some useful info / limitations:
Code: Select all
sync-connection-tracking=yesSome useful info / limitations:
- MikroTik uses its own proprietary protocol for connection syncing. Therefore, both routers must be MikroTik.
- Both routers must be running the same version of RoutersOS v7 (e.g., 7.1beta2).
- While VRRP allows multiple backup routers, the connection syncing protocol supports only one (i.e., there must be only two routers: one master + one backup).
- VRRP Preemption Mode must be disabled (preemption-mode=no).
- The connection syncing protocol uses IPv4 for the internal data channel. In case of IPv6 (v3-protocol=ipv6), remote-address is mandatory.
- In case of IPv4, remote-address is optional, however, recommended (reduces VRRP latency).
Re: VRRP sync-connection-tracking setup
If the above information is insufficient, please provide the output of:
from both routers.
If you have a VRRP password set, please manually remove it from the output, since the print command doesn't have a hide-sensitive option.
Code: Select all
/interface export hide-sensitive
/interface/vrrp print detail
If you have a VRRP password set, please manually remove it from the output, since the print command doesn't have a hide-sensitive option.
Re: VRRP sync-connection-tracking setup
This is fantastic.... but...If VRRP is up and running, then in most cases, simply settingon both ends should do the trick: VRRP master syncing its connection with the backup router.Code: Select allsync-connection-tracking=yes
Some useful info / limitations:
- MikroTik uses its own proprietary protocol for connection syncing. Therefore, both routers must be MikroTik.
- Both routers must be running the same version of RoutersOS v7 (e.g., 7.1beta2).
- While VRRP allows multiple backup routers, the connection syncing protocol supports only one (i.e., there must be only two routers: one master + one backup).
- VRRP Preemption Mode must be disabled (preemption-mode=no).
- The connection syncing protocol uses IPv4 for the internal data channel. In case of IPv6 (v3-protocol=ipv6), remote-address is mandatory.
- In case of IPv4, remote-address is optional, however, recommended (reduces VRRP latency).
What is the status of "firewall rules" sync between routers?
Or even better - config sync?
Are there any "suggested/verified" methods? There are some user proposed scripts... but nothing "universally useful"...
There is the excellent https://github.com/svlsResearch/ha-mikrotik but that's an active/passive solution requiring reboots for failovers which takes time and drops *any/all* state
Any plans in that regard? What do you suggest to use to have a "proper" HA (with minimal or no loss of connectivity) solution for Mikrotik devices?
Are there any "suggested" centralized management SW where you could edit/modify config to be automatically pushed to "paired" devices? That in combination with vrrp-sync could do the trick...
(if only Mikrotik config handling would allow direct "editing" (injecting/changing a specific <b>line</b> of configuration or some sort of <i>diff</i> apply...)
Any suggestions?
Re: VRRP sync-connection-tracking setup
Currently there are several centralised configuration management options: TR069, API, SSH, and now even REST.
Re: VRRP sync-connection-tracking setup
Yeah... I know about the "possibilities" or "options" for centralized management...
but are there any "suggested"/Recommended "product/solution" for that purpose?
I know about for ex Unimus and some other similar products and the TR-69 (Genie-ACS...) options... but it seems to me that's oriented more to "collecting configurations" than "managing" especially some HA (paired) setups.
Correct me if I'm wrong... or even better, suggest some "actual" solution.
Thanks!
Regards,
but are there any "suggested"/Recommended "product/solution" for that purpose?
I know about for ex Unimus and some other similar products and the TR-69 (Genie-ACS...) options... but it seems to me that's oriented more to "collecting configurations" than "managing" especially some HA (paired) setups.
Correct me if I'm wrong... or even better, suggest some "actual" solution.
Thanks!
Regards,
Who is online
Users browsing this forum: No registered users and 10 guests