Chapter 51 — When a router dies: VRRP and friends

   Router A  (priority 110)  \
                               >---  VIRTUAL IP:  192.168.1.1
   Router B  (priority 100)  /       VIRTUAL MAC: 00:00:5e:00:01:01

   Every device on the LAN uses 192.168.1.1 as its gateway.
   They have no idea two routers exist.

   Router A is MASTER: it answers ARP for the virtual IP and forwards traffic.
   Router B is BACKUP: it sits silently, listening.

   A sends a "still alive" message every second.
   If B misses three of them (~3 seconds), B takes over:
       - claims the virtual IP and virtual MAC
       - sends a gratuitous ARP so switches update their tables (Chapter 6!)
       - starts forwarding

   Devices notice nothing except a ~3 second pause.

The protocols

Two details that matter in practice

1. Track your uplink. A router that's alive but has lost its own internet connection is worse than useless — it'll happily be Master and blackhole everything. Interface tracking lowers its priority when the uplink fails, so the other router takes over.

2. Preemption. When the failed router comes back, should it take over again? Usually yes — but with a delay, so it has time to rebuild its routing tables first. Otherwise it becomes Master while it still has no routes.

Where you'll meet this

• Any office or data centre with redundant routers or firewalls
• Load balancers in a highly-available pair (keepalived + HAProxy is a classic)
• Your cloud provider does the equivalent invisibly — the "virtual router" in a VPC is already redundant
• Modern data centres increasingly use anycast gateways (every switch answers for the same gateway address) instead, but VRRP is still everywhere

# see VRRP on the wire if your network uses it
sudo tcpdump -i any -n 'vrrp or proto 112'

# a virtual MAC always starts 00:00:5e:00:01:xx -- check your ARP cache
ip neigh | grep -i '00:00:5e:00:01'
arp -a | grep -i '00:00:5e'

# what IS your gateway's MAC? Is it a virtual one?
ip neigh show $(ip route | awk '/default/{print $3; exit}')