keepalived allows to set an interface in the virtual_ipaddress context that differs from the interface set in the VRID settings. This allows for a dedicated VRRP interface to be used and virtual addresses to be set on another interface.
The configuration would look like this for keepalived:
vrrp_instance VRID100 { state BACKUP preempt_delay 180 # this interface is used for VRRP multicast traffic interface eth0 virtual_router_id 100 priority 100 advert_int 1 virtual_ipaddress { # this address gets bound to eth1 instead of eth0 192.0.2.1/24 dev eth1 } }
As for the Vyos configuration, I imagine something like this:
high-availability { vrrp { group VRID100 { interface eth0 preempt-delay 180 priority 100 virtual-address 192.0.2.1/24 { dev eth1 } vrid 100 } } }
Due to this configuration, no IPv4 address needs to be configured on eth1 for keepalived to be able to bind the address to it. Only the VRRP interface (here: eth0) needs to have an address configured. This adds security to a setup where you do not control every device in your L2 segment that is connected to eth1 because you would keep the multicast traffic in a secure environment (e. g. a direct cable between two Vyos boxes).
But this setup also depends on track_interface to be set for eth1 and dont_track_primary set in the vrrp_instance context. So in conclusion, the keepalived configuration would look like this:
vrrp_instance VRID100 { state BACKUP preempt_delay 180 # this interface is used for VRRP multicast traffic interface eth0 # dont track eth0 dont_track_primary virtual_router_id 100 priority 100 advert_int 1 # track the desired interface for the virtual addresses track_interface { eth1 } virtual_ipaddress { # this address gets bound to eth1 instead of eth0 192.0.2.1/24 dev eth1 } }
Is this something, that can be done?