Technical Tip: How To Properly Configure VRRP For Secondary IP Address

When VRRP is required for a secondary IP address, a network mask must be added to match the secondary IP address. The configuration is as shown in the following example:

config system interface
    edit "Test"
        set ip 20.1.1.12 255.255.255.0
        set allowaccess ping https http ssh telnet
        set vrrp-virtual-mac enable
        config vrrp
            edit 5
                set vrip 20.1.1.1
            next
            edit 9
                set netmask 255.255.255.0  <-----
                set vrip 20.2.2.100
            next
        end
        set secondary-IP enable
        set vlanid 24
        set interface "internal"
        config secondaryip
            edit 1
                set ip 20.2.2.12 255.255.255.0
            next
        end
    next
end

This is because VRRP always compares the network mask with the primary IP address. For the secondary IP address, the 'netmask' parameter is required to be added.