I have a few questions about my understanding if this is possible and how to achieve the following. As per the example diagram (simplified from potential network) I have a ring network as shown below. I can't change the topology. Network example

Each router is configured to use OSPF, advertising the two subnets &

Edit: OSPF will not be running on the interfaces of Router 4 & 5 on subnet

Router 4 has a VRRP Priority of 110, Router 5 has 100. If I setup VRRP tracking on Router 4/5 to subnet with a drop of 50.

Checking my understanding on this: Router 4 dies then (mirrored for 5):

  • VRRP ensures the devices use Router 5
  • OSPF ensures Router 1 (via Router 2) routes all traffic via Router 3

Router 2 dies then (mirrored for 3):

  • Router 1 routes all traffic via Router 3
  • OSPF ensures Router 4 loses route to subnet
  • Therefore Router 4 lowers its VRRP priority to 60 and devices use Router 5

Additionally, can I add a IPSec (or is it L2TP/IPSec for OSPF to function) tunnel over the 3rd party link and then route through the tunnel interfaces instead?

Thanks for any help, comments or recommendations.

Edit #2: Subnet is physically a long string of switches. How would I best solve a break where Router 4 and 5 now both have that subnet, but cannot talk VRRP to each other.

  • "Subnet is physically a long string of switches." That is an extremely poor design, and it really needs to be corrected to build a tree with a pair of distribution switches off of which the access switches have a connection back to each distribution switch.
    – Ron Maupin
    Feb 12, 2020 at 22:20
  • As that's more than my initial question I'd better add some information: Subnet is physically long in the >100 km range, each switch between 2 - 30 km apart, with a few devices attached to each switch. The devices on the subnet run a Layer 2 protocol for communication between each other (Profinet) and an aggregator device at each end sends the data to the server via IP packets. Feb 13, 2020 at 2:18

1 Answer 1


You may not get the results you intend.

Router 2 dies then (mirrored for 3):

Router 1 routes all traffic via Router 3 OSPF ensures Router 4 loses route to subnet Therefore Router 4 lowers its VRRP priority to 60 and devices use Router 5

Not quite. If R2 dies, R4 will still have a route to -- it's through R5. So it won't drop it's VRRP priority. If configured, it will also send an IP redirect to tell hosts to use R5. This is independent of VRRP.

Rather than tracking the destination subnet, track the uplink ( in the case of R4).

Remember that each router has a full view of the topology and calculates the shortest path independently.


Based on your comment, if the interfaces on R4 and R5 on the subnet are not in the OSPF domain, then the failover will work as you described IF you redistribute into OSPF (e.g. redistribute connected subnets or passive-interface).

  • Ahh thanks, I did not mean to include OSPF being active between Router 4 & 5, updated the post. Would it be worth tracking both the link and destination subnet for VRRP? Feb 12, 2020 at 13:58
  • What's the point of R4 if it's not participating in OSPF?
    – Ron Trunk
    Feb 12, 2020 at 14:03
  • Not participating on the interfaces of R4/5 that exist on the subnet That way R4 would drop its priority when R2 dies as it wont try route across R5, which should fix the behaviour you metioned? Feb 12, 2020 at 14:08
  • Another update, getting slightly out of scope; The subnet is actually a long string of switches with several devices off each switch. If a break were to occur in the middle of the subnet, Router 4 & 5 would both have a path to the subnet and both would be master, but OSPF would give Router 1 only 1 path (say Router 4) so the remaining devices connected to Router 5 would be able to send packets to the server, but they would be sent back via Router 4 and not reach the devices that sent it. Is the solution to that to add L2 redundancy to the subnet between Routers 4 & 5? Feb 12, 2020 at 22:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.