andrewluck,
Were you ever able to successfully implement this? I needed a similar setup for implementing plain failover routing (not vpn) and I have done it using the following strategy:
- I have no scripts on the master router:
[admin@master] > /interface vrrp print detail
Flags: X - disabled, I - invalid, R - running, M - master, B - backup
0 RM name="vrrp1" mtu=1500 mac-address=00:00:5E:00:01:31 arp=enabled interface=WAN vrid=49 priority=200
interval=1s preemption-mode=yes authentication=none password="" on-backup="" on-master="" version=2
v3-protocol=ipv4
1 RM name="vrrp2" mtu=1500 mac-address=00:00:5E:00:01:32 arp=enabled interface=LAN vrid=50 priority=200 interval=1s
preemption-mode=yes authentication=none password="" on-backup="" on-master="" version=2 v3-protocol=ipv4
- On the backup router I have the following setup:
[admin@backup] > /system script print
Flags: I - invalid
0 name="vrrp-master" owner="admin" policy=ftp,reboot,read,write,policy,test,winbox,password,sniff,sensitive,api
last-started=jan/02/1970 18:55:39 run-count=227 source=
:foreach e in=[/int vrrp find backup=yes] do={
/int vrrp set $e priority=250
}
1 name="vrrp-backup" owner="admin" policy=ftp,reboot,read,write,policy,test,winbox,password,sniff,sensitive,api
last-started=jan/02/1970 18:59:28 run-count=9 source=
:foreach e in=[/int vrrp find master=yes] do={
/int vrrp set $e priority=150
}
[admin@backup] > /interface vrrp print detail
Flags: X - disabled, I - invalid, R - running, M - master, B - backup
0 B name="vrrp1" mtu=1500 mac-address=00:00:5E:00:01:31 arp=enabled interface=WAN vrid=49 priority=150 interval=1s
preemption-mode=yes authentication=none password="" on-backup=vrrp-backup on-master=vrrp-master version=2 v3-protocol=ipv4
1 B name="vrrp2" mtu=1500 mac-address=00:00:5E:00:01:32 arp=enabled interface=LAN vrid=50 priority=150 interval=1s
preemption-mode=yes authentication=none password="" on-backup=vrrp-backup on-master=vrrp-master version=2 v3-protocol=ipv4
When one of the interfaces on the master goes down (either on the router itself or the ethernet switch) the corresponding interface on the backup router becomes master at which time its on-master script kicks in and increases the priority on the other interface of the backup router. This makes the backup router the new master.
Note that I only increase the priority of one of the interfaces in the on-master script. So when the master router's troubled interface is restored it forces the backup router to go back to its original state.
Things worth noting:
1. I was only able to get this working when the vrrp version was set to 2 not 3.
2. I am using the latest stable firmware on the RB450G which at the time of this post is 5.8
3. My switch (Cisco 2960) complained about the vrrp mac appearing on two interfaces. This happens when the routers are both in master mode and are trying to negotiate their status until one becomes backup. This might be worth noting if you use a managed switch. If your switch blocks traffic on any of the ports because it sees the same mac multiple ports then this could be break the communication between your routers thus preventing vrrp from functioning correctly.
4. My switch ports are setup as edge ports (no spanning-tree delays) so they go into forwarding mode as soon as they are activated