LFCE 108 🐧 VRRP — Virtual Router Redundancy - KandZ

⏱️ Estimated read: 10 min | |

VRRP is the protocol that makes a group of routers appear as a single default gateway to the hosts on a LAN. It is defined in RFC 2338 and updated by RFC 9568 for version 3 . The protocol creates a virtual router—an abstract object identified by a Virtual Router Identifier (VRID) and a set of IP addresses—and elects one physical router as the master to forward packets sent to those addresses . The previous chapter covered the Keepalived configuration; this chapter covers the protocol mechanics: the election, the advertisement timer, the master-down interval, and the security checks that determine whether a VRRP packet is accepted.

Quick How-To Guides & Fast FixesNeed a quick fix or step-by-step solution? Browse our fast answers on HowTo.KandZ.me:

Operating Systems CLI →Dev Environment Languages →Web Network Tools →Security Accounts →Security Access Tech →Device Phone Basics →Social Messaging →Digital Files Media →

The core problem VRRP solves is the default gateway as a single point of failure. A host configured with a static default gateway cannot fail over if that gateway dies. VRRP presents a virtual IP that the hosts use as their gateway, and the physical router behind that IP can change without the hosts knowing . The master sends periodic advertisements to signal its health, and the backups listen. If the advertisements stop, a backup takes over.

Key point: The master is elected by priority. The router with the highest priority becomes the master, and the other routers remain backups. If the priorities are equal, the router with the higher primary IP address wins . The master sends advertisements at the configured interval (default one second), and a backup declares the master dead after the Master_Down_Interval expires—three advertisement intervals plus a skew time based on the backup’s priority .

Why VRRP requires the election and the timers

The election problem.

A VRRP group can have many routers, but only one can be the master at a time. The election must be deterministic and fast. VRRP uses the priority field: the highest priority wins, and the tie-breaker is the primary IP address . The priority is configurable from 1 to 255, and the value 255 is reserved for the IP address owner—the router that has the virtual IP as a real interface address . The IP address owner always becomes the master when it is available, regardless of the other priorities.

The advertisement problem.

The master must prove it is alive. It sends a VRRP advertisement every Advertisement_Interval seconds. The advertisement contains the VRID, the priority, and the list of virtual IP addresses . The backups do not send advertisements; they only listen. If a backup stops receiving advertisements, it waits for the Master_Down_Interval and then transitions to master.

The timer problem.

The Master_Down_Interval is not a fixed value. It is calculated as 3 × Advertisement_Interval + Skew_Time, where Skew_Time = (256 − Priority) / 256 . The skew time gives the higher-priority backups a shorter wait, so they take over before the lower-priority backups. This is the mechanism that ensures the most preferred backup becomes the master when the current master fails.

a. The election and the priority

The priority determines the election outcome. The router with the highest priority becomes the master.

# The priority is configured in the keepalived.conf
vrrp_instance VI_1 {
    priority 200    # The master has the higher priority
}

The primary node is configured with priority 200 and the backup with priority 100. The primary wins the election and becomes the master. The backup remains in the backup state and listens for the advertisements .

The IP address owner has a special role. If a router has the virtual IP as a real interface address, it must use priority 255, and it always becomes the master when it is available . This is the mechanism that allows a router to reclaim the VIP when it comes back online, even if the current master has a higher configured priority.

The preemption mode.

By default, VRRP is preemptive. If a backup with a higher priority becomes available while a lower-priority master is running, the backup preempts the master and takes over . The preemption can be disabled with the nopreempt flag in Keepalived, which is the mechanism for the stable master that should not be interrupted by a returning higher-priority node .

b. The advertisement and the master-down interval

The master sends the advertisements, and the backup calculates the timeout.

# The Master_Down_Interval calculation
Master_Down_Interval = 3 × Advertisement_Interval + Skew_Time
Skew_Time = (256 − Priority) / 256

With the default advertisement interval of one second and a backup priority of 100, the Skew_Time is (256 − 100) / 256 = 0.609 seconds, and the Master_Down_Interval is 3 × 1 + 0.609 = 3.609 seconds . A backup with priority 200 has a Skew_Time of (256 − 200) / 256 = 0.219 seconds, and its Master_Down_Interval is 3.219 seconds. The higher-priority backup waits less, which is the mechanism that makes it the first to take over.

The master can also relinquish the master role voluntarily by sending an advertisement with priority 0 . A backup that receives the priority-0 advertisement sets its timer to the Skew_Time and transitions to master without waiting for the full Master_Down_Interval . This is the mechanism for the graceful shutdown.

c. The security checks and the TTL

VRRP version 3 does not include authentication. The earlier versions had simple password authentication, but the RFC 9568 states that “VRRP for IPvX does not currently include any type of authentication” . The operational experience showed that the authentication did not provide sufficient security and could cause multiple active routers through the misconfigured secrets . The protocol relies instead on the TTL/hop-limit check.

# The TTL check in VRRPv3
# The receiver MUST verify that the IPv4 TTL (or IPv6 Hop Limit) is 255
# If the check fails, the packet is discarded

The TTL check is the Generalized TTL Security Mechanism (GTSM). A VRRP packet with a TTL other than 255 is discarded, because a legitimate VRRP advertisement is generated on the local link and cannot traverse a router . This limits the VRRP attacks to the local network, and it prevents the remote injection of the forged advertisements.

The Keepalived authentication block is a legacy feature. The auth_type PASS and auth_pass are still accepted in the configuration, but they are only for the misconfiguration protection, not for the security against an attacker on the wire . The password is sent in clear text, and the VRRPv3 RFC does not use it.

Complete Example Session

# ============================================
# PART 1: THE VRRP GROUP CONFIGURATION
# ============================================
# The master: priority 200, the backup: priority 100
# The virtual_router_id: 51, the advert_int: 1

# ============================================
# PART 2: THE ELECTION
# ============================================
# The master sends the advertisements every 1 second
# The backup listens and waits

# ============================================
# PART 3: THE MASTER-DOWN CALCULATION
# ============================================
# Backup priority 100: Skew_Time = 0.609s
# Master_Down_Interval = 3 × 1 + 0.609 = 3.609s

# ============================================
# PART 4: THE FAILOVER TRIGGER
# ============================================
# The master stops sending the advertisements
# The backup waits 3.609 seconds
# The backup transitions to master

# ============================================
# PART 5: THE GRACEFUL SHUTDOWN
# ============================================
# The master sends the priority-0 advertisement
# The backup sets the timer to the Skew_Time
# The backup transitions immediately

# ============================================
# PART 6: THE TTL CHECK
# ============================================
# A VRRP packet with TTL != 255 is discarded
# The remote injection is prevented

# ============================================
# PART 7: THE IP ADDRESS OWNER
# ============================================
# A router with the VIP as a real address uses priority 255
# It always becomes the master when available

The seven parts demonstrate the VRRP protocol mechanics: the election, the advertisement, the master-down calculation, the failover trigger, the graceful shutdown, the TTL check, and the IP address owner.

Quick Reference

The Election

Parameter	Value
Priority range	1–255
Master	The highest priority
Tie-breaker	The higher primary IP address
IP address owner	Priority 255, always master when available
Preemption	Enabled by default

The Timers

Timer	Formula
Advertisement interval	Configurable, default 1 second
Skew time	`(256 − Priority) / 256` seconds
Master-down interval	`3 × Advertisement_Interval + Skew_Time`

The Security

Check	Rule
TTL / hop limit	Must be 255, or the packet is discarded
Authentication	Not in VRRPv3; the legacy Keepalived password is for the misconfiguration only

Best Practices

✅ Do This:

# Use the explicit priority difference
priority 200    # master
priority 100    # backup                                      # ✅

# Use the same virtual_router_id on all nodes
virtual_router_id 51                                          # ✅

# Allow the VRRP traffic through the firewall
# Protocol 112, multicast 224.0.0.18                          # ✅

# Use the IP address owner priority 255 when the router owns the VIP
priority 255    # The router always becomes master when available # ✅

❌ Don’t Do This:

# Use the same priority on both nodes
priority 100    # Both nodes → the IP address decides            # ❌

# Use the different virtual_router_id values
virtual_router_id 51    # Master
virtual_router_id 52    # Backup → the VIP never moves          # ❌

# Block the VRRP multicast
# The split-brain: both nodes become master                     # ❌

# Rely on the VRRP authentication for the security
# VRRPv3 does not have the authentication                          # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Both nodes are master	The VRRP multicast is blocked	Allow the protocol 112 and the `224.0.0.18`
The VIP does not move	The `virtual_router_id` differs	Use the same ID on all nodes
The failover is slow	The advertisement interval is too long	Reduce the `advert_int`
The preemption is unexpected	The preempt mode is enabled by default	Use `nopreempt` if the stable master is desired

Real-World Examples

1. The master configuration

vrrp_instance VI_1 {
    state MASTER
    priority 200
    virtual_router_id 51
    advert_int 1
}

2. The backup configuration

vrrp_instance VI_1 {
    state BACKUP
    priority 100
    virtual_router_id 51
    advert_int 1
}

3. The IP address owner

vrrp_instance VI_1 {
    priority 255    # The router owns the VIP
}

4. The graceful shutdown

# The master sends the priority-0 advertisement

5. The master-down calculation

Master_Down_Interval = 3 × 1 + (256 − 100) / 256 = 3.609s

6. The TTL check

The VRRP packet with TTL != 255 is discarded

7. The preemption disabled

vrrp_instance VI_1 {
    nopreempt    # The backup does not preempt the current master
}

8. The failover test

systemctl stop keepalived
# The backup takes over after the Master_Down_Interval

9. The virtual MAC address

The VRRP virtual MAC: 00:00:5e:00:01:<VRID>

10. The firewall rule

iptables -A INPUT -p vrrp -j ACCEPT

Visual

The VRRP Election

┌──────────────────────────────────────────────────────────────┐
│  THE HIGHEST PRIORITY BECOMES THE MASTER                     │
│                                                              │
│  Router A (priority 200)                                     │
│  └── Master: holds the VIP, sends the advertisements         │
│                                                              │
│  Router B (priority 100)                                     │
│  └── Backup: listens, waits for the master-down interval     │
│                                                              │
│  If the priorities are equal, the higher IP address wins.    │
└──────────────────────────────────────────────────────────────┘

The Timers

┌──────────────────────────────────────────────────────────────┐
│  THE MASTER-DOWN INTERVAL IS NOT FIXED                       │
│                                                              │
│  Skew_Time = (256 − Priority) / 256                          │
│  Master_Down_Interval = 3 × Advert_Interval + Skew_Time      │
│                                                              │
│  Priority 100: Skew 0.609s → Down 3.609s                     │
│  Priority 200: Skew 0.219s → Down 3.219s                     │
│                                                              │
│  The higher priority waits less.                             │
└──────────────────────────────────────────────────────────────┘

The TTL Check

┌──────────────────────────────────────────────────────────────┐
│  THE TTL CHECK LIMITS THE ATTACKS TO THE LOCAL LINK          │
│                                                              │
│  A legitimate VRRP advertisement:                            │
│  ├── Generated on the local link                             │
│  ├── TTL = 255                                               │
│  └── Cannot traverse a router                                │
│                                                              │
│  A remote injection:                                         │
│  ├── TTL is decremented by the routers                       │
│  ├── TTL != 255                                              │
│  └── The packet is discarded                                 │
└──────────────────────────────────────────────────────────────┘

Summary

Item	Value
Protocol	VRRP (RFC 2338, RFC 9568)
Virtual router	VRID + the set of the virtual IPs
Master election	The highest priority
Tie-breaker	The higher primary IP address
IP address owner	Priority 255, always master when available
Advertisement interval	Configurable, default 1 second
Master-down interval	`3 × Advert_Interval + Skew_Time`
Skew time	`(256 − Priority) / 256`
Preemption	Enabled by default
Security	The TTL/hop-limit check; no authentication in v3

Key takeaways:

VRRP creates a virtual router that the hosts use as their default gateway. The virtual router is identified by the VRID and the set of the virtual IPs, and one physical router is elected as the master to forward the traffic .
The election is decided by the priority. The highest priority becomes the master. The tie-breaker is the higher primary IP address. The priority 255 is reserved for the IP address owner, which always becomes the master when available .
The master sends the advertisements, and the backups listen. The advertisement interval is configurable (default one second). A backup declares the master dead after the Master_Down_Interval .
The Master_Down_Interval includes the skew time. The formula is 3 × Advert_Interval + (256 − Priority) / 256. The higher-priority backup waits less, which makes it the first to take over .
The master can relinquish the role with a priority-0 advertisement. A backup that receives the priority-0 advertisement transitions to master without waiting for the full Master_Down_Interval .
VRRPv3 does not have authentication. The TTL/hop-limit check (must be 255) limits the attacks to the local link. The legacy Keepalived password is for the misconfiguration protection, not for the security against an attacker on the wire .

Remember: VRRP is the protocol that makes the default gateway redundant. The master is elected by the priority, the backups listen for the advertisements, and the master-down interval determines the failover speed. The IP address owner has the special priority 255, and the TTL check limits the attacks to the local link. The result is the default gateway that survives the failure of the physical router, which is the difference between the single gateway that fails and the virtual router that continues.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!