How to Set Up VRRP with Two Routers and a Single Uplink

fhrprouterswitchubiquitivrrp

I am wondering if the following scenario is possible to setup VRRP using two routers (and forgetting about network redundancy upstream or redundancy on the switch):

Scenario:

  • Data center provides 1 single uplink cable to their network.
  • Data center provides 4 separate IP allocations to me (all on separate
    subnets).
  • Connect the DC uplink cable to a single switch.
  • Connect the WAN ports of both router to the same switch as the DC uplink cable.
  • Setup a Virtual IP between the two routers (on the WAN side).
  • Have a second switch with both routers LAN ports being connected to this.
  • Have a virtual IP for both routers on the LAN side.

Is the above the correct way to achieve this? Or would the routers need to be directly connected via two uplinks to the DC routers?

  • If the above scenario does work, how should I go about protecting the switch from being exposed on the WAN side of the routers (firewall) – as there is a web / ssh management interface – any tips?

Lastly, can I assign the multiple IP allocations (on separate subnets) to my both routers, even though the routers are not directly connected to the DC routers, but passing through the WAN side switch?

Thanks in advance for any assistance (and forgive my ignorance).

Best Answer

You can use VRRP, assuming your routers support it, but it requires at least two or three IP addresses in the same network. You need an address for each of the routers, and one address for the virtual address (some implementations of VRRP allow the virtual address to be the real address of one of the routers). The routers also need to be able to communicate with each other on the LAN where VRRP is used. You do this by connecting the router interfaces to the same layer-2 LAN.

Doing this on the WAN side of your routers will give the Data Center redundant access to your routers, but you will still have a Single-Point-of-Failure from your routers to the Data Center. The network for your link to the Data Center must be, at most, /29, since any longer mask will not provide more than two usable addresses, and the link will require, at least, three addresses.

Doing this on the LAN side of your routers provides the hosts on the LAN with router redundancy.

To protect the switch, you could place a transparent firewall between the Data Center and the switch, or you could use an unmanaged switch. You may want the firewall if your routers need protection, too. If your Data Center link only has two addresses, the firewall could terminate the link, and then it can provide a different network for your routers. Placing a router between your equipment and the Data Center creates another SPoF.

Routers route between networks, so having multiple networks attached to a router is normal.

Related Topic