2

I am configuring a WAN connection that utilizes Virtual Router Redundancy Protocol (VRRP) and involves two uplinks. My goal is to connect these uplinks to two firewalls set up in an active-backup high availability (HA) configuration. However, I'm concerned about the potential communication issues between the uplinks.

Is it possible for VRRP to function effectively if the two uplinks cannot directly communicate with each other? I've attached a diagram below to illustrate the intended setup. I received advice suggesting that direct communication between the uplinks is necessary, and I would like to verify this information.

Thank you for your assistance.

Diagram1

Improve this question
1
  • VRRP is an FRHP that works on a layer-2 domain to fool the hosts into thinking there is only one gateway. It must exist on the same layer-2 domain as the hosts and communicate between the physical routers on the layer-2 domain.
    – Ron Maupin ♦
    Commented May 6 at 12:30

1 Answer 1

Reset to default
1

Is it possible for VRRP to function effectively if the two uplinks cannot directly communicate with each other?

The involved routers need to be able to communicate with each other directly, via an HA link as your diagram indicates. Nothing else is necessary.

You can create a VRRP cluster on either the Vrrp level or the FW level - however, the former requires redundant linking between the Vrrp and the FW level (additional links between Vrrp1 and FW2, and between Vrrp2 and FW1).

LACP is a link aggregation protocol on layer 2. It has no relation with VRRP which is a layer-3 redundancy protocol.

Improve this answer
2
  • I don't think VRRP needs a dedicated direct link between the routers, though; it should be enough if the VRRP packets can reach the other router through the downstream switch
    – ilkkachu
    Commented May 8 at 14:30
  • @ilkkachu It's not a technical requirement, but when HA communication is disrupted each router thinks it's the active one. Better run a dedicated line between them. The "HA link" in my answer doesn't even imply a dedicated link, just suggests it.
    – Zac67 ♦
    Commented May 8 at 17:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.