R3721-F3210-F3171-HP High-End Firewalls High Availability Configuration Guide-6PW101

Interface GigabitEthernet0/1

VRID : 2 Adver Timer : 100

Admin Status : Up State : Master

Config Pri : 110 Running Pri : 110

Preempt Mode : Yes Delay Time : 0

Auth Type : None

Virtual IP : FE80::20

1::20

Virtual MAC : 0000-5e00-0202

Master IP : FE80::2

The output shows that in VRRP group 1, Firewall A is the master, Firewall B is the backup and the host with

the default gateway of 1::10/64 accesses the Internet through Firewall A; in VRRP group 2, Firewall A is

the backup, Firewall B is the master and the host with the default gateway of 1::20/64 accesses the

Internet through Firewall B.

NOTE:

To implement load balancing between the VRRP groups, be sure to configure the default gateway as 1::10

or 1::20 on the hosts on network segment 1::/64.

Troubleshooting VRRP

The screen frequently displays error prompts

Analysis

This error is probably caused by:

• Inconsistent configuration of the devices in the VRRP group.

• A device is attempting to send illegitimate VRRP packets.

Solution

• In the first case, modify the configuration.

• In the latter case, resort to non-technical measures.

Multiple masters are present in the same VRRP group

Analysis

• Multiple masters coexist for a short period: This is normal and requires no manual intervention.

• Multiple masters coexist for a long period: This is because devices in the VRRP group cannot receive

VRRP packets, or the received VRRP packets are illegal.

Solution

Ping between these masters, and do the following:

• If the ping fails, check network connectivity.

• If the ping succeeds, check that their configurations are consistent in terms of number of virtual IP

addresses, virtual IP addresses, advertisement interval, and authentication.