Architecture and operating model
VRRPv3 elects one router on a LAN as Active for a virtual IPv4 or IPv6 default gateway while Backup routers listen for advertisements. Clients use the virtual address rather than either physical router. IPv4 and IPv6 are separate virtual-router instances; even with the same identifier, operate and monitor their state independently.
Priority alone does not prove end-to-end health. A physical interface can stay up while the upstream route, firewall or WAN path fails. Tracking an interface, route or script lowers priority so a healthy Backup can take over. Set interval, rise and fall thresholds so a slow or noisy check does not create flapping.
Preemption lets a higher-priority router reclaim Active after recovery. On stateful firewalls without synchronized sessions, or during an unstable fault, that return can cause another interruption. GARP and unsolicited Neighbor Advertisement refresh virtual MAC/IP mappings; switch security and the virtualization layer must permit them.
- 1Advertisement and Active election
- 2Forward through virtual IP/MAC
- 3Health tracking and priority drop
- 4Backup takeover and neighbor refresh
Design parameters
- Advertisement interval
- Balance the failover target, packet-loss tolerance and control-plane load.
- Priority and tracking
- Each decrement must move the failed Active below the healthy Backup's priority.
- Preemption policy
- Choose from recovery stability, session impact and maintenance-window needs.
- Layer-2 controls
- Validate VRRP protocol traffic, virtual MAC, GARP and IPv6 unsolicited NA against network policy.
Worked example
With Active priority 150 and Backup 120, a WAN tracking decrement of 20 leaves Active at 130 and no takeover occurs. The decrement must be at least 31; using 40 yields effective priority 110. Measure total takeover with three failed one-second health checks and the configured advertisement loss threshold.
For a 200-client VLAN, test IPv4 and IPv6 virtual addresses separately. Record p50/p95 packet loss for Active power loss, upstream route loss and keepalived-process loss; one successful ping is not an acceptance test.
Example commands: replace lab values and confirm permissions and software versions before use.
sudo tcpdump -ni eth1 'ip proto 112 or ip6 proto 112 or arp or icmp6'
ip -4 addr show dev eth1; ip -6 addr show dev eth1
ip neigh show dev eth1
systemctl status keepalived
journalctl -u keepalived --since '-10 min'Troubleshooting
| Observation | Likely cause / distinction | Verification |
|---|---|---|
| Both routers report Active | VRRP multicast/protocol traffic may be blocked or VRID/prefix settings may differ. | Capture both ends and compare VRID, address family and advertisement interval. |
| Role changes but traffic does not return | Virtual MAC learning, GARP/NA or upstream ARP/ND cache may remain stale. | Record switch MAC and neighbor tables before and after failover. |
| Role flaps repeatedly | The health script may be slow or thresholds too sensitive. | Correlate script duration, rise/fall counters and priority events. |
Acceptance checks
- Validate IPv4 and IPv6 virtual routers independently.
- Prove VRRP packets pass between both routers.
- Measure that upstream tracking triggers takeover.
- Validate neighbor tables after GARP and unsolicited NA.
- Test preemption on and off with session impact.
- Record p95 failover for power, link, route and process failures.
Related concepts
Layer 2 and Layer 3 boundaries
A VLAN creates a separate broadcast domain; routing and access policies govern communication between VLANs. Review trunk allowed lists, access-port assignment and gateway placement together. A network diagram should show where packets are routed and filtered, not merely which cables connect devices. Sharing a switch does not require sharing privileges. When access fails, confirm VLAN and addressing first, then gateway, route and policy matching.
Failover and failback
Failover moves service to another component; failback returns it to the preferred location. Their risks and sequencing may differ. DNS updates, routing, sessions, replication lag and application dependencies determine user interruption. Define failover triggers, false-alarm behavior and approval for returning service. Simply shutting down a VM does not test every failure type. Measure network, storage and management-plane failures separately.
Availability versus recovery
High availability aims to keep service running through specified failures with a short interruption; backup recovers lost or corrupted data from an earlier point. A cluster can replicate an accidental deletion to another node. HA therefore does not replace backup. Consider DNS, identity, network, storage and power dependencies together. Successful node failover is insufficient by itself: measure user sessions, application writes and external integrations after the transition as well.
Telemetry and time correlation
Telemetry combines logs, metrics and events that explain system behavior. A log describes an event, a metric shows behavior over time, and a distributed trace follows a request across components. Clock differences can make one event appear to occur at several times. Use synchronized clocks, reliable source identifiers and consistent time-zone handling. Alarm design should consider duration and user impact alongside thresholds. Monitor gaps in collection separately: absence of logs must not be interpreted as absence of incidents.
Latency distribution
Latency is the time between starting an operation and receiving its result. An average can hide a small number of very slow operations; medians and p95/p99 percentiles answer different questions. Network RTT, storage waits, processor queues and application processing contribute to end-to-end time. State whether measurements come from the client or server. Check whether increases coincide with traffic growth, maintenance or capacity limits. Record normal and peak-hour baselines before selecting an alert threshold.
Capacity and usable headroom
Raw capacity is not the capacity available to applications. RAID or erasure coding, filesystems, reserved space, metadata, snapshots and growth headroom are separate deductions. TB and TiB representations also change the displayed number. Write calculations with units, establish protected usable capacity, then subtract operating reserves. Track growth rate as well as current utilization. The projected exhaustion date should leave enough time to procure and deploy additional capacity.
Primary documentation
Prepared by the Doz Teknoloji technical team using the primary references below. Calculations and lab scenarios state their assumptions; validate the applicable product version before rollout.