After a VRRP failover, the new master's VIP stops answering ARP, not because of anything wrong
with the election, but because VPP's own FIB keeps
a stale neighbor entry from before the failover and lets it win over the now-local VIP address.
Topology
Pair, eth1 VPP-bound on both nodes, VRRP1 vrid 1, VIP 192.0.2.100/24, priority 200 (r1) / 100 (r2),
hello-source-address set on both
Steps to reproduce
On r1:
set vpp settings interface eth1 set interfaces ethernet eth1 address '192.0.2.1/24' commit
On r2:
set vpp settings interface eth1 set interfaces ethernet eth1 address '192.0.2.2/24' commit
Configure the VRRP group
On r1:
set high-availability vrrp group VRRP1 interface 'eth1' set high-availability vrrp group VRRP1 vrid '1' set high-availability vrrp group VRRP1 priority '200' set high-availability vrrp group VRRP1 address '192.0.2.100/24' set high-availability vrrp group VRRP1 hello-source-address '192.0.2.1' commit
On r2:
set high-availability vrrp group VRRP1 interface 'eth1' set high-availability vrrp group VRRP1 vrid '1' set high-availability vrrp group VRRP1 priority '100' set high-availability vrrp group VRRP1 address '192.0.2.100/24' set high-availability vrrp group VRRP1 hello-source-address '192.0.2.2' commit
r1 (priority 200) should show VRRP1 eth1 1 MASTER, r2 VRRP1 eth1 1 BACKUP
On r2:
ping 192.0.2.100 count 5
Expect 0% packet loss.
Then:
ip neigh show 192.0.2.100 dev eth1
Expect 192.0.2.100 lladdr <r1 MAC> REACHABLE r2 now has r1's MAC cached for the VIP.
trigger a failover
set high-availability vrrp group VRRP1 disable commit
confirm r2 took over
show vrrp
Expect VRRP1 eth1 1 MASTER
check the stale neighbor survived the transition.** On r2 (now master):
vppctl show ip neighbors
Expect to still see:
192.0.2.100 D 52:54:00:01:01:00 eth1
try to reach the VIP from the old master.
ping 192.0.2.100
Expected
Once the VIP is local to the new master, ARP requests for it should be answered normally, the
election is healthy, VIP should be fully reachable.
Actual
PING 192.0.2.100 ... From 192.0.2.1 icmp_seq=1 Destination Host Unreachable From 192.0.2.1 icmp_seq=2 Destination Host Unreachable From 192.0.2.1 icmp_seq=3 Destination Host Unreachable 3 packets transmitted, 0 received, +3 errors, 100% packet loss
ip neigh show 192.0.2.100 dev eth1 on the old master: 192.0.2.100 FAILED.
show interfaces
eth1 192.0.2.2/24 52:54:00:02:01:00 default 1500 u/u
192.0.2.100/24Confirms the VIP is correctly assigned to r2
vppctl show ip neighbors
Age IP Flags Ethernet Interface 226049.7132 192.0.2.1 D 52:54:00:01:01:00 eth1 226018.1804 192.0.2.100 D 52:54:00:01:01:00 eth1
vppctl show ip fib 192.0.2.100/32
192.0.2.100/32 fib:0 index:15 locks:3
interface refs:1 entry-flags:connected,local, src-flags:added,contributing,active, cover:9
path-list:[29] locks:2 flags:local, uPRF-list:21 len:0 itfs:[]
path:[37] pl-index:29 ip4 weight=1 pref=0 receive: oper-flags:resolved, cfg-flags:local,
[@0]: dpo-receive: 192.0.2.100 on eth1
adjacency refs:1 entry-flags:attached, src-flags:added, cover:-1
path-list:[26] locks:1 uPRF-list:18 len:1 itfs:[1, ]
path:[29] pl-index:26 ip4 weight=1 pref=0 attached-nexthop: oper-flags:resolved,
192.0.2.100 eth1
[@0]: ipv4 via 192.0.2.100 eth1: mtu:1500 next:5 flags:[] 5254000101005254000201000800
Extensions:
path:29 adj-flags:[refines-cover]
forwarding: unicast-ip4-chain
[@0]: dpo-load-balance: [proto:ip4 index:16 buckets:1 uRPF:21 to:[0:0]]
[0] [@12]: dpo-receive: 192.0.2.100 on eth1Both sources are present at once for the same /32:
- interface (local/receive) installed because r2 is now master and the VIP is its own address.
- adjacency the stale entry pointing at r1's MAC, left over from steps before