Guides

VRRP

Redundant gateway via a shared virtual router (master/backup failover).

VRRP lets two SiHA appliances share a virtual IP address on a segment so that clients always have a reachable gateway — even if one node fails. One appliance is elected master and owns the virtual address; the other stays backup and takes over automatically if it stops hearing the master’s advertisements.

The unit of configuration is a VirtualRouter: it declares a VRID (virtual router ID), a list of virtual addresses, and a priority. Two nodes form a redundant pair by each declaring a VirtualRouter with the same VRID and virtual addresses on the same L2 segment, but with different priorities — the higher priority becomes master.

Configuration

Single pair, one virtual address

# On the primary node (higher priority → master)
type: VirtualRouters.vrrp.siha
metadata: { namespace: vrrp, id: ext-vr }
spec:
  interface: ext           # COSI id of a link.siha Interface
  vrId: 10                 # VRID 1–255, shared by both nodes
  priority: 200            # higher wins (default VRRP master priority is 100)
  addresses:
    - 10.0.0.1             # the floating gateway address clients use
---
# On the backup node (lower priority → backup)
type: VirtualRouters.vrrp.siha
metadata: { namespace: vrrp, id: ext-vr }
spec:
  interface: ext
  vrId: 10
  priority: 100
  addresses:
    - 10.0.0.1

Both resources carry the same id, vrId, and addresses. Only priority differs. The node with priority: 200 wins the election and becomes master; the node with priority: 100 becomes backup.

Multiple virtual addresses

You can declare more than one floating address per VRID. All addresses in the list must be the same address family (all IPv4 or all IPv6):

spec:
  interface: ext
  vrId: 20
  priority: 200
  addresses:
    - 203.0.113.1
    - 203.0.113.2

Optional fields

spec:
  interface: ext
  vrId: 10
  priority: 200
  addresses: [10.0.0.1]
  intervalCs: 100     # advertisement interval in centiseconds (default: 100 = 1 s)
  preempt: true       # allow a higher-priority node to reclaim master (default: false)
  accept: true        # master accepts packets addressed to the virtual IP (default: false)

vrId must be 1–255. priority must be 1–255 (255 is the IP address owner, validated separately). Omitting intervalCs and preempt is safe for most deployments.

L2 requirements

VRRP advertisements are multicast frames (IPv4: 224.0.0.18, IPv6: ff02::12). The segment between the two appliances must deliver them.

On a virtualized L2 segment (a Linux bridge in a lab), plain VRRP multicast usually passes, but a bridge with vlan_filtering=1 drops 802.1Q-tagged frames — including VRRP advertisements sent on VLAN sub-interfaces. If you’re running VRRP on a VLAN interface, disable VLAN filtering on the bridge:

ip link set <bridge-name> type bridge vlan_filtering 0

On a cloud fabric, VRRP multicast is typically blocked by the ports’ anti-spoofing rules unless you explicitly allow 224.0.0.18 in the port’s allowed address pairs.

Operating

S="sihactl --sihaconfig ~/.siha/config --addr <node-ip>:6443"

$S get virtualrouter                 # list all virtual routers + live state
$S get virtualrouter ext-vr -o yaml  # full spec + status (state, swIfIndex, lastError)

The default table shows the most useful columns:

Column	Source	Notes
`interface`	spec	the Interface resource the VR is attached to
`vrId`	spec	VRID shared by both nodes
`priority`	spec	this node’s priority
`addresses`	spec	the floating address(es)
`state`	status	`MASTER`, `BACKUP`, `INIT`, or `INTERFACE_DOWN`
`error`	status	last error reported by VPP’s vrrp_plugin, if any

A healthy active/standby pair shows one node as MASTER and the other as BACKUP. INIT means the plugin is still negotiating. INTERFACE_DOWN means the declared interface is not operationally up — bring the interface up first.

To check both nodes simultaneously:

# On the primary:
$S get virtualrouter ext-vr -o yaml

# On the backup (separate --addr):
sihactl --sihaconfig ~/.siha/config --addr <backup-ip>:6443 get virtualrouter ext-vr -o yaml

Aliases accepted by sihactl get: virtualrouters, virtualrouter, vr.