> Source: [sk39676](https://support.checkpoint.com/results/sk/sk39676)
# sk39676 - VRRP FAQ
| Property | Value |
|----------|-------|
| Solution ID | sk39676 |
| Date Created | 2009-04-14 |
| Last Modified | 2023-05-01 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |
## Solution
Show the entire FAQ
* **How many cluster members are supported in VRRP cluster?**
> VRRP cluster on Gaia OS - only 2 members.
* **How many VRRP interfaces are supported in VRRP cluster on Gaia OS?**
> When VRRP cluster is configured per [sk92061 - How to configure VRRP on Gaia](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92061) (i.e., the "ClusterXL" is *enabled* in the cluster object for State Synchronization), a maximum of 127 VRRP interfaces are supported.
>
> This because the same cluster member must be the VRRP Master for all virtual routers (VRIDs) to avoid an Active/Active scenario.
> A maximum of one VRID with one VIP address per interface is supported.
> And each VRID must be configured to monitor every other VRRP-enabled interface along with priority deltas that facilitate complete failover to the VRRP Backup cluster member.
>
> With a maximum priority of 254 and minimum priority delta of 2 per monitored interface, the maximum number of interfaces possible is 127.
* **Does VRRP cluster on Gaia OS support Active/Active environments?**
> * When VRRP cluster *is* configured per [sk92061 - How to configure VRRP on Gaia](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92061) (i.e., the "ClusterXL" is *enabled* in the cluster object for State Synchronization), only Active/Passive environments are supported.
>
> This allows only one VRID with one VIP address per interface.
> The same cluster member must be the VRRP Master for all VRIDs configured to avoid an Active/Active scenario.
> As such, each VRID must be configured to monitor every other VRRP-enabled interface along with priority deltas that facilitate complete failover to the VRRP Backup cluster member.
> * When VRRP cluster is *not* configured per [sk92061 - How to configure VRRP on Gaia](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92061) (i.e., the "ClusterXL" is *disabled* in the cluster object), Active/Active environments can be deployed.
>
> The maximum qualified number of cluster members is two.
> Each cluster member can be the VRRP Master for one of two VRIDs on an interface at the same time.
> Only Static Routes are supported with this configuration.
> **Important Note:** "Monitor Firewall State" must be disabled with this configuration.
* **What is the RFC number for VRRP v2, and where can I get a copy?**
> VRRP v2 is defined in [RFC 2338](https://www.rfc-editor.org/info/rfc2338).
> This is an excerpt from this RFC:
> > This memo defines the Virtual Router Redundancy Protocol (VRRP). VRRP specifies an election protocol that dynamically assigns responsibility for a virtual router to one of the VRRP routers on a LAN. The VRRP router controlling the IP address(es) associated with a virtual router is called the Master, and forwards packets sent to these IP addresses. The election process provides dynamic fail over in the forwarding responsibility should the Master become unavailable. This allows any of the virtual router IP addresses on the LAN to be used as the default first hop router by end-hosts. The advantage gained from using VRRP is a higher availability default path without requiring configuration of dynamic routing or router discovery protocols on every end-host.
* **Where can I find more detailed configuration information for VRRP?**
> Refer to:
> * Gaia Administration Guide - Chapter "High Availability"
> * [sk92061 - How to configure VRRP on Gaia](https://support.checkpoint.com/results/sk/sk92061)
> * [sk105170 - Configuration requirements / considerations and limitations for VRRP cluster on Gaia OS](https://support.checkpoint.com/results/sk/sk105170)
> * [sk98226 - Dynamic Routing and VRRP Features on Gaia OS](https://support.checkpoint.com/results/sk/sk98226)
* **In summary, which VRRP should one use?**
> The best performance comes with VRRP Monitored Circuit (VRRP MC).
>
> The only reasons one should consider VRRP v2, are:
> * either it is necessary to establish VRRP between Check Point Security Gateway and a platform from another vendor
> * or there are no extra IP address to use for VRRP MC
* **How much time does it take for a VRRP transition?**
> Section 6.1.2 in the [RFC 2338 (VRRP v2)](https://www.rfc-editor.org/info/rfc2338) states the following:
> > Master_Down_IntervalTime interval for Backup to declare Master down (seconds). Calculated as:
> > > `(3 * Advertisement_Interval) + Skew_time`
> >
> > Skew_Time: Time to skew Master_Down_Interval in seconds. Calculated as:
> > > `( (256 - Priority) / 256 )`
>
> This means that the greater the priority, then the smaller the skew_time, which results in a faster transition.
> Therefore, using a priority of 254 will result in faster transition times.
>
> The next question would be to ask, "Why is it designed this way?".
> In VRRP v2, the master always has a priority of 255. A backup may have a priority =\< 254.
> If there was a power failure and both platforms rebooted, this gives the master the edge in reclaiming its position in the VRRP hierarchy.
>
> Typically, failover occurs between 3-4 seconds, using default values.
* **Can VRRP be used to backup a physical interface connected to a LAN with another physical interface connected to the same LAN?
In other words, can we use *eth-s1p2* to backup *eth-s1p1* on the same LAN?**
> **The VRRP protocol does not support having 2 logical interfaces in the same broadcast domain.**
> Use Link Redundancy or Link Aggregation to achieve this.
* **Can I change the Multicast IP address that VRRP uses from 224.0.0.18 to something else?**
> No.
> **224.0.0.18 is the defined Multicast address for VRRP and cannot be changed.**
* **Must I setup an established VRRP Master?**
> An established VRRP Master is the cluster member configured with a priority that is greater than the priority of the VRRP Backup(s).
> A good reason for this configuration is when the VRRP Master is a more robust platform than the VRRP Backup platform.
> However, if the two cluster members are identical, either one can be the VRRP Master.
> Then, the VIP priorities can be the same on each platform. It will usually be the first cluster member, which comes online.
* **Could there be a problem associated with equivalent priorities between two cluster members?**
> It is possible, though improbable, that during a simultaneous reboot of VRRP cluster members, one cluster member becomes the VRRP Master for the external VIP address and the other cluster member becomes the VRRP Master of the internal VIP address.
>
> There is a tie-breaking algorithm used in situations like this to prevent this very occurrence.
> **Should both VRRP cluster members see VRRP "HELLO" packets from each other at the same time, the cluster member with the numerically greater IP address becomes the VRRP Master.**
> For this reason, it would be wise for all interfaces on one cluster member to be numerically greater than the interfaces on the peer cluster member.
> For example, Member_A should be the X.X.X.2 host and Member_B should be the X.X.X.1 host on all connected interfaces.
* **What is the "`cphaprob state`" output in a VRRP cluster?**
> ClusterXL runs in Sync-only mode and both cluster members are considered "Active". Output of the "`cphaprob state`" command would look like this:
>
> ```
> HostName[admin]# cphaprob state
>
> Cluster Mode: Sync only (OPSEC) with IGMP Membership
>
> Number Unique Address Firewall State (*)
> 1 (local) 11.11.11.34 Active
> 2 11.11.11.35 Active
>
> (*) FW-1 monitors only the sync operation and the security policy. Use OPSEC's monitoring tool to get the cluster status.
> ```
* **Where do I observe VRRP Master / Backup state?**
> VRRP Master / Backup state can be observed either in OS WebUI, or OS CLI.
>
> |-------------------------|---------------|----------------------------------------------------------------------------------------------------------------------------------------------------------|
> | Operating System | Where? | How? |
> | VRRP cluster on Gaia OS | Gaia Portal | * Go to the "High Availability" section - click on the "VRRP" page - in the upper right corner, click on the "Monitoring" tab. |
> | VRRP cluster on Gaia OS | Gaia Clish | * `show vrrp` * `show vrrp interface ` * `show vrrp interfaces` * `show vrrp stats` * `show vrrp summary` |
> | VRRP cluster on Gaia OS | Documentation | * Gaia Administration Guide - Chapter "High Availability" * [sk92061 - How to configure VRRP on Gaia](https://support.checkpoint.com/results/sk/sk92061) |
>
> **Note:**When using VRRP VMAC mode both spanning tree and IGMP snooping must be disabled to avoid split brain.
**Related Solutions:**
* [sk105170 - Configuration requirements / considerations and limitations for VRRP cluster on Gaia OS](https://support.checkpoint.com/results/sk/sk105170)
* [sk92061 - How to configure VRRP on Gaia](https://support.checkpoint.com/results/sk/sk92061)
* [sk98226 - Dynamic Routing and VRRP Features on Gaia OS](https://support.checkpoint.com/results/sk/sk98226)
* [sk45028 - VRRP errors explained](https://support.checkpoint.com/results/sk/sk45028)[](https://support.checkpoint.com/results/sk/sk40618)
---
# Agent Instructions
This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.
## Navigating This Knowledge Base
- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content