Thu May 20, 2021 12:39 am
1. re-wording what @JelleM wrote: all routers negotiating using VRRP which one of them will listen on a particular IP address must be in the same L2 segment (VLAN). They use that same L2 segment to inform each other about their state.
2. re-wording what @JelleM wrote as well: you can have multiple VRRP interfaces, each with an individual MAC address and with an individual IP address, in the same subnet, with different priorities of the routers. So while all routers are alive, each VRRP interface is in master mode on one of them; once one of the routers fails, the VRRP interface that preferred this router goes up on the next one by priority. So this is the way to provide the load distribution among the routers.
3. if you run different VRRP instances at different physical interfaces of a router, it can happen that one physical interface goes down and another one stays up, so the router can't reach one of the networks it is supposed to route between.
3a. to prevent that router from staying a VRRP master in the surviving network, you have to use the on-master and on-backup scripts on the /interface vrrp rows - once the physical interface goes down, you have to lower the priority of the VRRP instances on the other physical interface. But there's a catch, VRRP determines its state based solely on reception of the VRRP packets from other routers in the group. So when a physical interface goes down, the VRRP interface attached to it becomes a master as it can't see any incoming VRRP packets. Hence the on-master script must check the state of the underlying interface and take an appropriate action depending on it, which is to increase the priority of the VRRP instances attached to the other interface if its underlying interface is up, and to decrease it if its underlying interface is down. The on-backup script just restores the normal priorities.
3b. instead of the scripts modifying priority, you may prefer to use a backup route to the network that goes missing via another router in the source subnet. This will result in the packet being delivered and ICMP "better gateway available" message sent back to the source, which may or may not honor it, but this way is not compatible with stateful firewalls on the routers, as the traffic paths are not symmetric. Synchronization of the connection tracking database from the master router to the backup one is only available in RouterOS 7.