This article describes how to configure VRRP in a situation where it is necessary to apply the parameter over a secondary IP address.
Scope
FortiSwitch v7.2.10, 7.4.6, 7.6.2 and above.
Solution
When VRRP is required for a secondary IP address, a network mask must be added to match the secondary IP address. The configuration is as shown in the following example:
config system interface edit "Test" set ip 20.1.1.12 255.255.255.0 set allowaccess ping https http ssh telnet set vrrp-virtual-mac enable config vrrp edit 5 set vrip 20.1.1.1 next edit 9 set netmask 255.255.255.0 <----- set vrip 20.2.2.100 next end set secondary-IP enable set vlanid 24 set interface "internal" config secondaryip edit 1 set ip 20.2.2.12 255.255.255.0 next end next end
This is because VRRP always compares the network mask with the primary IP address. For the secondary IP address, the 'netmask' parameter is required to be added.
